SFR+100 and R+100 8065 memory access

All disassembly, programming and code discussions belong here.
jsa
Posts: 33
Joined: 16 Feb 2021, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: SFR+100 and R+100 8065 memory access

Unread post by jsa »

0x3a+0x100=0x13a

It's an address inside the uP. It's a register. R13A.

A bank prefix operation is not used to access it.

If you use other address modes to access it, it will be coded 3a,01 in the binary, no bank prefix operation.

Look in the test bins for examples where a different address mode accesses the address R13a without a bank prefix opcode.
wwhite
Posts: 56
Joined: 16 Feb 2021, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: SFR+100 and R+100 8065 memory access

Unread post by wwhite »

Using a 8065 uP, with 4 banks, opcode ^A0, Load Word (LDW) Direct Address Mode only, there is no Rombank prefix option for Direct Address Mode on LDW, only Indirect and Indexed can use Rombank prefix for opcode A0, and data can be loaded to and from any 1 of the 4 banks.

Direct Address Mode LDW with odd addresses will use different rombanks, without the Rombank prefix.

Back to this mystery R13a uP register, it's only in some random uP's?
In code, you want to access register 0x3a, but if you access 0x3b as a word, your saying 'some' uP's interpret that as 0x3a+100??
This +100 is coming from your decompiled assembly correct?
jsa
Posts: 33
Joined: 16 Feb 2021, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: SFR+100 and R+100 8065 memory access

Unread post by jsa »

Agreed arguing theoretical semantics is fruitless.

A lot 8065 decompiled OEM binaries have multiple instances of sf/rxx+100 and R2xx+100.

The log files in the linked zip show that VILE supports +100 but P3M does not. Both are 8065's but different steppings. It is not random.

8061's are not expected to support +100.
I'm running this on 8061.
Which catchcode did you run it on?
Have you got an 8065 to try it on?
wwhite
Posts: 56
Joined: 16 Feb 2021, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: SFR+100 and R+100 8065 memory access

Unread post by wwhite »

I found my answer of the +100, and it makes sense with what I am saying.
(e.g., '^1OO denotes register address location '^00 in RAM bank #1).
Back to R13a, R3a+100, should be R3a^100 meaning "^13a denotes register address location '^3a in RAM bank #1'

For the fun of it, initialize R13a in all RAM banks to 0x00.
Also, initialize all R3a in all RAM banks to 0x00.

Data log all R13a in all RAM banks.
Also, Data log all R3a in all RAM banks.

Set some temp word register to your test value other than 0x00, say value 0x6464
Use LDW(^A0) to set R3a to the temp word register.
Use LDW(^A0) to set R3b to the temp word register.

What Data Banks now contain the value 0x6464?
And what is R13a set to??
wwhite
Posts: 56
Joined: 16 Feb 2021, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: SFR+100 and R+100 8065 memory access

Unread post by wwhite »

Catch code JFA7 has none, this is my bench EEC
KRAF5_LFQ1 has hundreds.

Have a couple of SD48, and one SD47
jsa
Posts: 33
Joined: 16 Feb 2021, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: SFR+100 and R+100 8065 memory access

Unread post by jsa »

wwhite wrote: 09 Apr 2021, 03:44 Back to R13a, R3a+100, should be R3a^100 meaning "^13a denotes register address location '^3a in RAM bank #1'
Ford are quite happy to refer to the registers as 0020 to 03ff.
R13A is a valid description, I'll continue to describe it in that manner.
Feel free to call them whatever you like.
Ford register.png
Ford registers.png

wwhite wrote: 09 Apr 2021, 03:55 Catch code JFA7 has none, this is my bench EEC
KRAF5_LFQ1 has hundreds.

Have a couple of SD48, and one SD47
JFA7 / KMAK6 has none of what?
Can you run both test bins on it and post the logs?

KRAF5 has hundreds of what?
Can you run both test bins on it and post the logs?

SD47 and SD48, assuming they are 8061's, are not expected to support SF/R+100.
wwhite
Posts: 56
Joined: 16 Feb 2021, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: SFR+100 and R+100 8065 memory access

Unread post by wwhite »

jsa wrote: 09 Apr 2021, 07:17 JFA7 / KMAK6 has none of what?
My disassembly of stock JFA7.bin has no references for ^A0 ldw direct address mode with a SF/R+100.
jsa wrote: 09 Apr 2021, 07:17 KRAF5 has hundreds of what?
Hundreds of ^A0 ldw direct address mode with hundreds of SF/R+100 & SF/R+200.
SD47 and SD48, assuming they are 8061's, are not expected to support SF/R+100.
Correct, there is only one bank.


It'' be a couple of weeks for me to run the test bench, currently bench is a cluster of tools, stripping car parts and building heads.
wwhite
Posts: 56
Joined: 16 Feb 2021, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: SFR+100 and R+100 8065 memory access

Unread post by wwhite »

jsa wrote: 09 Apr 2021, 07:17 Ford are quite happy to refer to the registers as 0020 to 03ff.
R13A is a valid description, I'll continue to describe it in that manner.
Feel free to call them whatever you like.
Of course R13a is a valid register, byte value located between R139 and R13b.
Its byte location is R13a, size of one byte.
Its word location is R13a, size of two bytes, hi byte being R13b and lo byte being R13a.
Its double word location is R13a, using up four(4) bytes in memory R13a, R13b, R13c, R13d.
Sorry, me being condescending, I'm bad. We'll get this figured out.

Lets look at word register R156 for another example, located in memory somewhere between 0020 and 03ff.
Lets use word direct addressing, and load a word using opcode ^A0.
program counter is removed, since it is irrelevant.
This is also pseudo code from my head, you get the idea.

Code: Select all

a0, 56, 58    ldw R56, R58    R58 = R56   // EVEN addressing = Bank0, A0=0

Code: Select all

a0, 57, 58    ldw R156, R58    R58 = R156 // ODD addressing = Bank1, A0=1
R156 does not mean register 0x0156 in Bank0.
R156 means register 0x0056 in Bank1

Bank0 R156 does not equal Bank1 R56.

I called Ford, and they responded with the following:
Word direct addressing references uses A0 to select a RAM bank pair.
During ASSEMBLY of the source code, this number appropriately sets bit A0 in the reference address at the machine code level(e.g.,^100 at source code converts to a reference address in the machine code).
Screen Shot 2021-04-09 at 9.39.03 AM.png
Since we are disassembling here, we need to do the reverse.
I am 100% positive SAD is not taking account for ^A0 being odd or even to select the correct bank pair for word direct addressing.

Also, looking at SAD, the dissembler source code, should hint to where the problem is.
We cannot assume that SAD is perfect, it has bugs, this is one of them.

Code: Select all

 if (o->addr < 0x100)   o->addr += rambnk;     // always zero if not 8065

//but if later 8065, odd o_addr in word mode = + 0x100 !!     opt   if (PSTPD)

  o->addr = databank(o->addr,c);                // add bank
A lot of SAD is cryptic to me, and I have not been able to get the debugger working.
Then there is some comments like this:

Code: Select all

// set databank here for correct [Rx++] calls ? if t->type == 1
Not sure if the above is a ternary operator, or if the programmer is questioning what is going on. There is no code below this comment.

Code: Select all

#define PSTPD     (cmdopts & 0x1000)     // set step D for 8065 (odd boundaries)
What does PSTPD stand for?
wwhite
Posts: 56
Joined: 16 Feb 2021, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: SFR+100 and R+100 8065 memory access

Unread post by wwhite »

Lets look at what the Sub2340_test is doing, in detail, and we'll use PSW bit 9 and bit 8 set/clear for the fun of it.

Code: Select all

2340: a1,64,00,3c         ldw   R3c,64           Odd_Md_Val = 64;                  # Load test value for Direct Odd Mode Addressing
Pretty straight forward, ^A1 opcode is LDW Immediate addressing mode.
PSW bit 9 = 0, select bank Bank0 or Bank1
Data word is even, destination breg is even, select least significant bank or even bank(Bank0 or Bank2),
Register 3c will be located in Bank0.

What happens when PSW bit 9 is set?
PSW bit 9 = 1, select bank Bank2 or Bank3
Data word is even, destination breg is even, select least significant bank or even bank(Bank0 or Bank2),
Register 3c will be located in Bank2


Next line of code:
RAM bank selection for an 8-bit address pointer reference relies solely upon the logic state of PSW bits 8 and 9.

Code: Select all

2344: c7,01,3a,01,3c      stb   R3c,[R0+13a]     Odd_Md_Rg = Odd_Md_Val;
^C7 opcode is STB Long Indexed addressing.
PSW bit 9 = 0, select bank Bank0 or Bank1
PSW bit 8 = 0, select Bank0
IndexRa = R0, offset = 13a, breg = R3c, [Ra] = R13a(000)
Bank0 ^3c -> (^13a + (Bank0 + R^00))
Bank0 ^3c -> (Bank1 + 3a)
Destination Register R3c in Bank0 will contain the value from Register R3a in Bank1.

What happens when PSW bit 9 = 1, and bit 8 =1?

Code: Select all

PSW bit 9 = 1, select bank Bank2 or Bank3
PSW bit 8 = 1, select Bank3
IndexRa = R0, offset = 13a, breg = R3c, [Ra] = R13a(300)
Bank3 ^3c -> (^13a + (Bank3 + R^00))
Bank3 ^3c -> ( Bank1 + 3a)
Destination Register R3c in Bank3 will contain the value from Register R3a in Bank1.

Next line of code, similar to previous, but with an ODD offset:

Code: Select all

2349: c7,01,3b,01,3d      stb   R3d,[R0+13b]     Odd_Md_Rg^ = Odd_Md_Val;
Odd offsets have no effect on Indirect or Indexed, only PSW bit 8 and 9 have complete control of what bank of Byte operation registers to use.

Next line of code:
(side note: this is a fun exercise, I'm learning so much :) )

Code: Select all

234e: a1,3a,3b,3a         ldw   R3a,3b3a         Even_Md_Rg = 3b3a; 
^A1, LDW Immediate addressing
Data = 0x3b3a, Destination = R3a
PSW bit 9 = 0, select bank Bank0 or Bank1
Destination breg is even, select least significant bank or even bank(Bank0 or Bank2), 
Register 3a will be located in Bank0.
What happens when PSW bit 9 is set?
PSW bit 9 = 1, select bank Bank2 or Bank3
Destination breg is even, select least significant bank or even bank(Bank0 or Bank2),
Register 3a will be located in Bank2

Almost there, to see results....

Next line of code, ODD addressing

Code: Select all

2352: a0,3b,30            ldw   R30,R13a         Log_Rg = Odd_Md_Rg;          
^A0 LDW Direct word addressing
PSW bit 9 = 0, select bank Bank0 or Bank1
SourceRA R3b is ODD, we select Bank1 (areg = address bits 1-7 = R3a)
DestRB = R30, is EVEN, we select Bank0
Register R30 in Bank0 is loaded with the value from Register R3a in Bank1.
What happens if PSW bit 9 =1?

Code: Select all

2352: a0,3b,30            ldw   R30,R13a         Log_Rg = Odd_Md_Rg;          
^A0 LDW Direct word addressing
PSW bit 9 = 1, select bank Bank2 or Bank3
SourceRA R3b is ODD, we select Bank3 (areg = address bits 1-7 = R3a)
DestRB = R30, is EVEN, we select Bank2
Register R30 in Bank2 is loaded with the value from Register R3a in Bank3.
Last line of code, I promise:

Code: Select all

2355: c3,01,10,04,30      stw   R30,[R0+410]     Mode_Result = Log_Rg;  
^C3, STW, Long Indexed
// don't care about PSW
// also don't care about EVEN or ODD address spaces
// now we are only concerned with Address bits 8 an 9, to select RAM Bank#.
IndexRA = R0, offset = 410, breg = R30, [Ra] = R30(000)
A8, A9 = 0x0410 = 0B0000 0100 0000 1010, bit 8=0, bit9=0, select Bank0 
Bank0 ^30 -> (^410 + (Bank0 + R^00))
Bank0 ^30 -> Bank0 + 410
Register R410 will have value of R30 both in Bank0


Lets do a summary table:

Code: Select all

Register.    |.   Symbol.            |.  Bank#.            | Value
R3a.          |.  Even_Md_Rg.     | Bank0 if PSW9=0. | 3b3a
                                               | Bank2 if PSW9=1 |
R3c.          |. Odd_Md_Val.       |Bank0 if PSW9=0. | 64
                                               | Bank2 if PSW9=1 |
R3c.          |   byte_low.(13a)   | Depends on PSW(8,9)
                                               | Bank0     (0,0)   | 3a
                                               | Bank1      (1,0)  | ?indeterminate?
                                               | Bank2      (0,1)  | 3a
                                               | Bank3       (1,1) | ?indeterminate?
R3d.          |.  byte_hi.             |  | Depends on PSW(8,9)
                                               | Bank0     (0,0)   | 3b
                                               | Bank1      (1,0)  | ?indeterminate?
                                               | Bank2      (0,1)  | 3b
                                               | Bank3       (1,1) | ?indeterminate?
R13a.        |            |.                |
R13b.        |  
R30.          |.  Log_Rg. (ODD).  | Bank0 if PSW9=0.|R3a from Bank1 
                                              | Bank2 if PSW9=1 | R3a from Bank3 
                                              
R410         |.  Mode_Result.      | Bank0 | value from R30 in Bank0                                               
So, as you can see, the only Data Banks being used are 0 and 2, with the original 3b3a and 64 word values.

Reg R30, with ODD addressing loads values from Bank1 and Bank3, which have not been initialized.

I really do not see, or understand how your test cases are valid.
wwhite
Posts: 56
Joined: 16 Feb 2021, 15:53
Location: Victoria, BC, Canada
Vehicle Information: 1994 Flarside, XLT, 351w E4OD
SD48b, Quarter Horse, Burn2

Re: SFR+100 and R+100 8065 memory access

Unread post by wwhite »

I think you should initialize all variables in all banks, and log PSW as well, then look at the results.
Post Reply