EEC V file conversion

[jsa]

I am slightly confused on the HEGO_DATA_BFR areas here.

I mentioned earlier that the DMR generated DIR might have errors, you have found one.
This goes to being aware of address modes, and then time to check them all.
An immediate value of 0x400 is being loaded here.
It may go on to be used as an address, which would correctly receive HEGO_DATA_BFR as the correct name.
It could be many things.
In this case it is used 2 calls deep at L92CF2, it's added to BG_TMR.

It's a classic example of why the immediate load naming problem still exists with SAD.
Attempts to get SAD to track immediate values later used as an address have proved futile so far.
If it's known to not be an address then it could be unnamed. Catch 22, addresses end up unnamed because the address could not be tracked.

The solution to date has been the user is king, adjust the DIR to suit.

TVRFAN- if you can have SAD reference the CMT file to see if that line is assigned a scalar name that would be significantly helpful.

The solution as it stands is to change the DIR using address ranges.
Change this line in the DIR;

Code: Select all

SYM 400 "HEGO_DATA_BFR"   #UY

To this block in the DIR;
The 2nd line is optional.
I'd place it at the 400 location in DIR.

Code: Select all

SYM  0400 02000 9435B "HEGO_DATA_BFR"
SYM  0400 9435C 9438F "0x400"           #   # Immediate Load
SYM  0400 94390 9FFFF "HEGO_DATA_BFR"

V4.07.16B throws an error in CMT if the above example is used.
This works for V4.07.16B and V4.012

Code: Select all

SYM  0400 02000 0FFFF "HEGO_DATA_BFR"   #UY
SYM  0400 12000 1FFFF "HEGO_DATA_BFR"  
SYM  0400 82000 8FFFF "HEGO_DATA_BFR"
SYM  0400 92000 9435B "HEGO_DATA_BFR"
SYM  0400 9435C 9438F "0x400"           #   # Immediate Load
SYM  0400 94390 9FFFF "HEGO_DATA_BFR"

It quickly becomes cumbersome for repetitive immediate values, having to create each range before/after and banks as well.
I've previously suggested changing to a global name with alternate zones.
Like this;

Code: Select all

SYM 400 "HEGO_DATA_BFR"   #UY
SYM 9435C 9438F 400 "0x400"           #   # Immediate Load

As TVRfan has said, any suggestions are good suggestions.

EDIT: Fixed ranged address order and added 4.07.16b version.

[BOOSTEDEVERYTHING]

Yes. That does help. Thank you. I will play around with that a little with a hex calculator and see what I get with some of the other ones. I have a question on the bank identification though. Bank 1 you said you would add 11 to the front of the address result? What would I add if it was another bank? Also how would I tell what bank it is referencing? Thanks again.

Finding the error helps as well. I can research this and find out how to see it as an error. You mentioned address modes, can you please give me an example of how I can tell that this is not what it seems please? Thanks you.

[BOOSTEDEVERYTHING]

ok, Also, I changed the dir file to

Code: Select all

SYM 02000 9435B 400 "HEGO_DATA_BFR"   #UY
SYM 9435C 9438F 400 "0x400"           #   # Immediate Load
SYM 94390 9FFFF 400 "HEGO_DATA_BFR"

I put it in place of the 0400 entry as directed.

And still get this result in the RZASA lst file after running sad again

Code: Select all

9435c: 57,f6,6a,00,24     ad3b  R24,R0,[Rf6+6a]  R24 = [13900];
94361: d7,1c              jne   9437f            if (R24 = 0)  {
94363: a3,d4,22,36        ldw   R36,[Rd4+22]     R36 = TPBAR_MT;
94367: a0,23,38           ldw   R38,R122         R38 = TP;
9436a: a1,00,04,3a        ldw   R3a,400          R3a = HEGO_DATA_BFR;
9436e: ef,3b,e9           call  92cac            Sub_92cac ();
94371: c3,d4,22,42        stw   R42,[Rd4+22]     TPBAR_MT = R42;
94375: 88,37,42           cmpw  R42,R136         
94378: db,05              jc    9437f            if (R42 < RATCH)  {
9437a: c0,37,42           stw   R42,R136         RATCH = R42;
9437d: 20,62              sjmp  943e1            goto 943e1; } }

9437f: a0,37,36           ldw   R36,R136         R36 = RATCH;
94382: a0,23,38           ldw   R38,R122         R38 = TP;
94385: 88,36,38           cmpw  R38,R36          
94388: db,06              jc    94390            if (R38 < R36)  {
9438a: a1,00,04,3a        ldw   R3a,400          R3a = HEGO_DATA_BFR;
9438e: 20,15              sjmp  943a5            goto 943a5; }

Did I do something wrong? I was hoping to see what the lst file should look like without the error.

EDIT: I did do something wrong. I withdraw this post. I was saving the dir file to the wrong place and reusing the one I did not change .I apologize for the confusion

[jsa]

Found this one. I'm still working out exactly what it is doing, I'll edit this post later if I can figure it out, lol.
Also, where can I find a calculator to figure out that this-[Rec+c8] is [11548]? I have downloaded a couple of hex calculators from the apple app store but cant seem to find one that works well for me. Thanks so much for your help, again.

Part of the trick is that the base address is unsigned, but the offset is signed.
It really requires intermediate steps converting to decimal, adding (subtracting) then back to hex.

SO... On the [Rec+c8] question, Do I need to look up that register in the msg file to get the number in it and then add the offset, or do I add the ec+c8 when trying to find the address?

And is the number in the msg file in hex or is it dec?

As TVRfan has said, the Rbase that SAD has found are listed at the top of MSG.
If SAD has not found an rbase automatically, you can add it to DIR using the RBAse command.

As per previous, look up the opcode to determine the address mode, and read about address modes in the manuals.
viewtopic.php?p=12500#p12500
viewtopic.php?p=12440#p12440

You want the address contained in EC.
That is unsigned 0x11580 = dec71040
Signed C8 = dec-56
71040-56=70984
dec70984=0x11548

Or you could do TVRfan's trick of
0x100-0xC8=0x38
0x11580-0x38=0x11548

The inclusion of letters in the value is a dead giveaway that the value is hexadecimal. If they happened to be all numerals, then find where the value is loaded into REC in the bin and look at the opcode and operands.

ldw R32,[Rd4+20] R32 = RATCH_REP
in dir file I have this
SYM 03A0 "RATCH_REP" #UW

I just dont understand how to get to the 03a0 from [Rd4+20].

RD4 contains 0x380
0x380+0x20=0x3A0.
You can do the intermediate decimal steps if you wish.

also there is no RBase d4 in the msg file for RZASA. Well, in the msg file when not using a dir file anyways. So how do I come up with something usable on these types of examples? Thanks

Semi Automatic Disassembler has not identified the rbase D4 (and others), so user is king, I've added the RBAse command to the DIR you have. It's the 2nd command in the DIR.

[jsa]

ok, Also, I changed the dir file to

Code: Select all

SYM 9435C 9438F 400 "0x400"           #   # Immediate Load

I put it in place of the 0400 entry as directed.

Oops, blunder on my part.
Amended post above for V4.07.16B and V4.012

I get this with V4.012

Code: Select all

9436a: a1,00,04,3a        ldw   R3a,400          TMP4L = 0x400;
9436e: ef,3b,e9           call  92cac            Sub_92cac ();
94371: c3,d4,22,42        stw   R42,[Rd4+22]     TPBAR_MT = TMP8L;
94375: 88,37,42           cmpw  R42,R136         
94378: db,05              jc    9437f            if (TMP8L < RATCH)  {
9437a: c0,37,42           stw   R42,R136         RATCH = TMP8L;
9437d: 20,62              sjmp  943e1            goto 943e1; } }

9437f: a0,37,36           ldw   R36,R136         TMP2L = RATCH;
94382: a0,23,38           ldw   R38,R122         TMP3L = TP;
94385: 88,36,38           cmpw  R38,R36          
94388: db,06              jc    94390            if (TMP3L < TMP2L)  {
9438a: a1,00,04,3a        ldw   R3a,400          TMP4L = 0x400;

EDITED

[BOOSTEDEVERYTHING]

Sorry, I was doing something wrong. I edited my post above. I was saving the dir file to the wrong location and using the unedited one. I apologize for the confusion. I was using 4.07.16b with the rzasa files and 4.012 with eqe3.

[BOOSTEDEVERYTHING]

Here is what I have added so far to the eqe3 dir file. I do have an error somewhere I need to find with one of the sym commands and can't seem to find it.

Code: Select all

# 20231016 Directive for use with SAD V4.012


RBA d4 280
RBA d6 380 
RBA d8 480 
RBA da 680 
RBA dc 880 
RBA de 980 
RBA e0 a80 
RBA e2 1080 
RBA e4 1180 
RBA e6 1280 
RBA e8 1380 
RBA ea 1480 
RBA ec 1580 
RBA ee 1680

RBA 36 1258f
RBA 34 1258e



# -----------Scalars Functions Tables Payloads ----------

SYM   180 "TP"	          		  #UW
SYM   182 "RATCH"			  #UW
SYM   184 "TP_REL"			  #UW

SYM   19C "iAICE_Ch8"                     # W
SYM   19E "iADC_Ch8"                      # W

SYM   1A0 "iADC_Ch9"                      # W
SYM   1A2 "iADC_ChF"                      # W
SYM   1A4 "iADC_Ch7"                      # W
SYM   1A6 "iADC_Ch2"                      # W
SYM   1A8 "iAICE_Ch2"                     # W
SYM   1AC "iAICE_Ch4"                     # W

SYM   1B0 "iAICE_Ch3"                     # W
SYM   1B4 "iAICE_Ch5"                     # W

SYM   1C0 "iADC_Ch0"                      # W
SYM   1C2 "iADC_Ch1"                      # W
SYM   1C4 "iAICE_ChF"                     # W
SYM   1C6 "iAICE_Ch11"                    # W

SYM   1CC "iMAF"                          # W
SYM   1CE "iADC_Ch6"                      # W

SYM   1D2 "iADC_ChC"                      # W
SYM   1D4 "iADC_Ch5"                      # W
SYM   1D6 "TP_CNT1"                       #UW # Throttle position counts 1
SYM   1D8 "TP_CNT2"                       #UW # Throttle position counts 2
SYM   1DA "TP_CNT3"                       #UW # Throttle position counts 3
SYM   1DC "TP_CNT4"                       #UW # Throttle position counts 4
SYM   1DE "TP_ENG"                        #UW # Average throttle position

SYM   1ea "LOAD"                          #UW

SYM   E1C "iADC_ChA"                      # W

#SYM   Rca "FLAGTEMP_BG"                   #UY
#SYM   R9a "CRKFLG"                        :B7


SYM   108de "RATKAM"                      #UW

SYM   10920 "P1120STATE"                  #UY
SYM   10922 "P0122STATE"                  #UY
SYM   10924 "P0123STATE"                  #UY

SYM   1112e "J1979_01_11"                 #UY

SYM   1154a  "P1120_FIL"                   #UY
SYM   1154b  "P0122_FIL"                   #UY
SYM   1154c  "P0123_FIL"                   #UY
SYM   1154d  "P0121_FIL"                   #UY

SYM   1154E "TPBAR_MT"                    #UW

SYM   11550 "RATCH_REP"                   #UW

SYM   11226 "iAICE_Ch9"                   # W

SYM   11362 "MAF"                         # W

SYM   11548 "TP_ENG_LAST"                 #UW # Previous average throttle position

SYM   11552 "TP_DIF_CTR"                  #UY

SYM   120a6 "RATIV"

SYM   120a8 "RATCH_MIN"                   #W

SYM   R1ea  "LOAD"                        #UW

SYM   1636e "ALT_PPM"                   #SW

FUN 12254 122CB "uuwFn036_MAF_Transfer" :W V 13107 :W V +1 P +5      # Mass Air Flow meter transfer function. CDAN 24-6







# ----------- Bank 0 Commands ----------
sca 0485C
sca 04954
sca 04F41
sca 050B9
sca 050FB
sca 0512A
sca 05159
sca 0517C
sca 05240
sca 052C8
sca 052D6
sca 0536A
sca 05403
sca 05523
sca 055db
sca 05628
sca 05698
sca 056F6
sca 05751
sca 057A0
sca 057CC
sca 057F9
sca 05802
sca 05B65

sca 08610

sca 095CB
sca 095D5
sca 095DF
sca 095E9
sca 09651
sca 096B9
sca 096C1
sca 096E6
sca 0970B
sca 0971B
sca 09935
sca 0993C
sca 09947
sca 0994B
sca 0994F
sca 09953
sca 09957
sca 09974

arg 0E8DF 0E8E7 :O 2 UW  :O 2 UY :UW :UY







# ----------- Bank 1 Commands ----------

#WOR 16BE6 16D60

STR 16D8A 16DB7 $Q1 :Y :WN                  # AD_Conversion Structure
STR 16DB8 16DD0 $Q1 :Y :WN                  # AICE Conversion Structure


# ----------- Bank 8 Commands ----------

SYM 82060 "NPTRS"                           #UY
SYM 82061 "NCALS"                           #UY

sca 83359
sca 8335F
sca 83363
sca 845B1
sca 87619
sca 87C93
sca 87CA1
sca 87CAA
sca 87DA6
sca 87E4E
sca 87E9F
sca 87ED5
sca 8D9C7
sca 8E026
sca 8E02C
sca 8E038
sca 8E0A4
sca 8E11C
sca 8E122
sca 8E194
sca 8E19A

# ----------- Bank 9 Commands ----------

sca 94B68


# ------------ Subroutine list----------
Sub 82000 "Sub_82000_Boot"
Sub 83202 "SLU83202_SUYFn"    $ F suyflu 36 :E4 F0 N :WN
Sub 83208 "SLU83208_SSYFn"    $ F ssyflu 36 :E4 F0 N :WN
Sub 8320D "SLU8320D_USYFn"    $ F usyflu 36 :E4 F0 N :WN
Sub 83212 "SLU83212_UUYFn"    $ F uuyflu 36 :E4 F0 N :WN
Sub 83219 "SLU83219_UUYFn"    $ F uuyflu 36

Sub 83265 "SLU83265_SUWFn"    $ F suwflu 36 :E4 F0 N :WN
Sub 8326B "SLU8326B_SSWFn"    $ F sswflu 36 :E4 F0 N :WN
Sub 83270 "SLU83270_USWFn"    $ F uswflu 36 :E4 F0 N :WN
Sub 83275 "SLU83275_UUWFn"    $ F uuwflu 36 :E4 F0 N :WN
Sub 8327C "SLU8327C_UUWFn"    $ F uuwflu 36

[decipha]

The cmt file has to be part directive too

if a value is loaded then reference the cmt to see if its given a name

CMT File
9438b // TC_TPR

one could even put that in the directive file if it will reference it
as it stands now if you put in you dir

9438b sym "TC_TPR"

it wont use it

[tvrfan]

BOOSTED,
Sorry if you are already beyond this, but just to confirm numbers, hexadecimal is 0-9 then A-F representing decimal 10-15. In binary, this uses 4 bits, so each hex digit is four bits. In 'techie" so there is no confusion, written hex values are prefixed by '0x' . Signed values use the top bit, minus is 0x80 for bytes, 0x8000 for words. Nearly all common CPUs use this system for +ve and -ve. Be careful, because code can also have unsigned values mixed in, (i.e. 0 to 0xffff) and unfortunately there's no easy way to tell without looking at the code.

A LOT of values in the bins are actually 'binary scaled' (an example would be say '1 atmosphere = 0x4000' ), also A/D conversions are 0x12800 = 5.12 volts, used for most sensors, but lots of other scales are around too, e.g. x/4 or x/8, x/128 and so on. This is done because decimal divide and multiply take *FOREVER* in CPU terms, and so are avoided by scaling this way. Shifts (= divide/multiply in binary) are very FAST.

The RBASE explanation is that SAD will auto detect an rbase ONLY if the value of a register never changes. Some of the subroutines set an rbase value locally but there's no way to know automatically, as this register is then used elsewhere. If you find one like this, you can do
RBASE <register> <value> <start> < end> which says "this rbase register is valid between start address and end address only".

Also -
Banks are 0,1,8,9 and the '11' is not right as you stated, '11234' is address 1234 in bank 1. (There is a reason why it's 0,1,8,9 ... later !!!)
Code always starts in Bank 8 at 0x2000. The 8065 CPU is still 16 bit core, with bank extensions 'nailed on' later to get more address space.
Ford (so far) always seem to put the data in Bank 1, the other banks being code. ROM space (read only, code) typically begins at 0x2000 in each bank, and addresses 0x400-0x1fff are typically RAM (and in bank 1). Addresses are input (and printed) as 0xBnnnn (where 'B' is bank number).
registers are the only addresses to have no bank (0-0x3ff). [Yes, there have been arguments about this !!]

[jsa]

The cmt file has to be part directive too

if a value is loaded then reference the cmt to see if its given a name

CMT File
9438b // TC_TPR

one could even put that in the directive file if it will reference it
as it stands now if you put in you dir

9438b sym "TC_TPR"

it wont use it

Try this...
Put this in DIR

Code: Select all

SYM 9438B "TC_TPR"                    # W

Put this in CMT

Code: Select all

9438B # [9438B] \s9438B

Run SAD V4.012, LST should now look like;

Code: Select all

9438a: a1,00,04,3a        ldw   R3a,400          TMP4L = 400;                      # [9438B] TC_TPR

The \s prefix in CMT is telling SAD to print that sym name assigned to 9438B.
SAD 4.07.16B has a bug, so it does not print the TC_TPR from sym 9438B