SFR+100 and R+100 8065 memory access
-
- Posts: 285
- Joined: 2021 Feb 16, 15:46
- Location: Australia
- Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV
Binary Editor
ForDiag
SFR+100 and R+100 8065 memory access
PYM, TVRFan and I aware that the disassemblers are not handling SFR+100 and R+100 memory offsets in all cases.
I have written test bins to dis/prove conjecture around the SF/R+100 memory offset.
The files can be found at;
https://github.com/OpenEEC-Project/EEC- ... -Test-Bins
They are well worth a look.
We'd be interested in your results if you decide to run them on your own hardware.
Edit: Fix link
I have written test bins to dis/prove conjecture around the SF/R+100 memory offset.
The files can be found at;
https://github.com/OpenEEC-Project/EEC- ... -Test-Bins
They are well worth a look.
We'd be interested in your results if you decide to run them on your own hardware.
Edit: Fix link
-
- Posts: 321
- Joined: 2021 Feb 16, 15:53
- Location: Victoria, BC, Canada
- Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2
Re: SFR+100 and R+100 8065 memory access
I'm running this on 8061. First issue I notice is that you haven't defined the stack pointer address, and the stack counts downs.
In my case, the stack SFR R10, appears to be zero, counts down to 0xFFFE, which is non-writable address space.
My stock bin, stack is pointing to 0x0900, and I think its size is 0xff.
The stack pointer value is indeterminate after a reset, and must be software cleared.
Not sure if the 8065 is different? or have I miss read the code?
In my case, the stack SFR R10, appears to be zero, counts down to 0xFFFE, which is non-writable address space.
My stock bin, stack is pointing to 0x0900, and I think its size is 0xff.
The stack pointer value is indeterminate after a reset, and must be software cleared.
Not sure if the 8065 is different? or have I miss read the code?
-
- Posts: 285
- Joined: 2021 Feb 16, 15:46
- Location: Australia
- Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV
Binary Editor
ForDiag
Re: SFR+100 and R+100 8065 memory access
Set the Scalar STACK_SFR to 8061 and write the update to the QH.
That will change the Stack SFR from 0x20 to 0x10.
Reboot the EEC, the stack address will be loaded to 0x10.
The OEM stack address does not have to be followed. The stack can be put elsewhere.
Look at the definition spreadsheet. It tells you what is written where for the 8061 and 8065 options.
Look at that address in the LST.
R20 becomes R10 when when STACK_SFR is changed to 8061 then written.
Reboot to take effect.
Both have the stack below 0x200.
What catchcode is your BIN?
That will change the Stack SFR from 0x20 to 0x10.
Reboot the EEC, the stack address will be loaded to 0x10.
The OEM stack address does not have to be followed. The stack can be put elsewhere.
Look at the definition spreadsheet. It tells you what is written where for the 8061 and 8065 options.
Look at that address in the LST.
R20 becomes R10 when when STACK_SFR is changed to 8061 then written.
Reboot to take effect.
Both have the stack below 0x200.
Code: Select all
2201: a1,00,02,20 ldw R20,200 STACK_8065 = 200;
-
- Posts: 321
- Joined: 2021 Feb 16, 15:53
- Location: Victoria, BC, Canada
- Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2
Re: SFR+100 and R+100 8065 memory access
Adjusted my stack pointer.
Found an issue with the following line:
My emulator shows disassembly as:
The problem is that R3b is not word aligned, and your disassembler shows it as R13a.
Should disassemble as
Also, using Ghidra, it is impossible to disassemble due to the misalignment.
The above screen shot shows RAM area, double word reg RL38, then word reg R3a, and byte reg R3b.
I'm not sure if your trying to log a word or a byte.
If byte R3b, then opcode needs to change.
If word, 3b, needs to change.
Found an issue with the following line:
Code: Select all
2352: a0,3b,30 ldw R30,R13a Log_Rg = Odd_Md_Rg;
Code: Select all
// AssemblerFormat: LDW areg, breg
// Instruction operation: (RB)<-(RA)
// Execution states: 4
// Machine Format: [ ^A0 ], [ SourceRB ], [ DestRA ]
0x2352: LDW 0xA0, areg 0x3b, breg 0x30
AddressMode [Direct]
Get Word Register:R3A = 0x3B3A
Set Word Register:0x30 = 0x3B3A[hi: 0x3B lo: 0x3A]= 0x3A3B
Should disassemble as
Code: Select all
2352: a0,3b,30 ldw R30,R3a
I'm not sure if your trying to log a word or a byte.
If byte R3b, then opcode needs to change.
If word, 3b, needs to change.
-
- Posts: 321
- Joined: 2021 Feb 16, 15:53
- Location: Victoria, BC, Canada
- Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2
Re: SFR+100 and R+100 8065 memory access
I'm just trying to understand the actual problem.
# Load test value for Direct Odd Mode Addressing
Is this test supposed to load a WORD from an ODD address space?
# Load test value for Direct Odd Mode Addressing
Is this test supposed to load a WORD from an ODD address space?
-
- Posts: 285
- Joined: 2021 Feb 16, 15:46
- Location: Australia
- Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV
Binary Editor
ForDiag
Re: SFR+100 and R+100 8065 memory access
Now you are on too it.
Does not matter what the Ford and other literature says, emulators do or disassemblers find. It only matters what the silicon does.
On some 8065 stepping processors, your concern from above, 3b is actually word 13a.
The whole point of the test is to discover what certain hardware versions do.
Does not matter what the Ford and other literature says, emulators do or disassemblers find. It only matters what the silicon does.
On some 8065 stepping processors, your concern from above, 3b is actually word 13a.
The whole point of the test is to discover what certain hardware versions do.
-
- Posts: 321
- Joined: 2021 Feb 16, 15:53
- Location: Victoria, BC, Canada
- Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2
Re: SFR+100 and R+100 8065 memory access
That does not make any sense.
Opcode A0 is direct addressing mode, using source register and destination register.
The bin plainly shows source register as 3b, and destination register 30.
The byte value in register 3b is set to the value 0x3b, from the previous opcode A1 ldw 3a, 3b3a.
Loading a word from register 3b, will actually load bytes 3a, 3b, takes more clock ticks.
Where 3b is odd, and on multibanks, uses this for odd or even bank number.
Where is word 13a coming in to play?
-
- Posts: 285
- Joined: 2021 Feb 16, 15:46
- Location: Australia
- Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV
Binary Editor
ForDiag
Re: SFR+100 and R+100 8065 memory access
A supporting uP decodes a double/word op odd address 3b as 3a+100.
-
- Posts: 321
- Joined: 2021 Feb 16, 15:53
- Location: Victoria, BC, Canada
- Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2
Re: SFR+100 and R+100 8065 memory access
Right, so, word address of 3b, is actually just word address 3a, being odd, it is ram bank #1
Using this line of code again:
Code: Select all
2352: a0,3b,30 ldw R30,R13a
R3b is odd, it is a word, so it is R3a, and is Bank#1.
I think the statement 3a+100 is incorrect, unless I am totally missing something.
-
- Posts: 321
- Joined: 2021 Feb 16, 15:53
- Location: Victoria, BC, Canada
- Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2
Re: SFR+100 and R+100 8065 memory access
Another example:
I still do not see where the R3a + 100 = R13a comes from.
Code: Select all
2352: a0,3a,30 ldw R30(Bank0),R3a(Bank0)
2352: a0,3b,30 ldw R30(Bank0),R3a(Bank1)
2352: a0,3a,31 ldw R30(Bank1),R3a(Bank0)
2352: a0,3b,31 ldw R30(Bank1),R3a(Bank1)