Code: Learning Disassembly Assembly

[EagleMark]

From 1project2many:

EagleMark's post below made me realize it would be a good idea to have a place for code questions. Anything goes, so to speak, as long as it's code related. Assembly, Modula, C++, Motorola, Intel, Whatever.

------------------------------------------------

$4F XDF Fuel VE table goes to 5200 RPM, but the assembly only goes to 4800? Somone started at 400 RPM instead of 0 RPM.

Odd? Have you ever seen how much Air managmant code is in a $6E assembly? And I can't find a way to turn it off? In $42 it's just a temp on and timer...

Since I'm stating to understand looups and sub routines how about a lesson on the commands? I just grabbed this piece and BOLD, Italic and UNDERLINED some examples.


;--------------------
; LK UP ACCEL ENRICH
; vs Diff TPS
; ** PUMP SHOT **
;--------------------
D775: LDAA #255
D777: LD777 LDX #$D312 ; ACCEL ENRICH vs Diff TPS TBL
; Contrib vs Diff TPS TBL
D77A: JSR LFAD7 ; 2D LK UP
;
D77D: LDAB L00DF
D77F: ORAB #$10 ; BIT 4
D781: BRA LD786
;
D783: LD783 CLRA
D784: ANDB #$EF ; 0111 1111
D786: LD786 STAB L00DF
D788: STAA L0058 ; BPW, MSB
D78A: STAA L009A
D78C: CLRA
D78D: LDAB L00DF
D78F: BITB #4 ; BIT 2
D791: BEQ LD796
;
D793: LDAA LD28F ; 183 Usec, BPW ADDER TO BPW WHILE
; IAC IS OPENING
; VAL MSEC = 16.384

D796: LD796 ADDA L0058 ; BPW, MSB
D798: BCS LD79E
; ... else
D79A: ADDA L0059 ; BPW, LSB
D79C: BCC LD7A0
; ... else
D79E: LD79E LDAA #255 ; MAX LMT
D7A0: LD7A0 BEQ LD7BE
;
D7A2: LDAB L0098
D7A4: MUL
D7A5: LSRD ; DIV BY 8
D7A6: LSRD
D7A7: LSRD
D7A8: ADDD L0096
D7AA: STD L0096
D7AC: LDAB L0006
D7AE: LDAA L000D
D7B0: BITA #$40 ; BIT 6
D7B2: BNE LD7B6
; ...... else
D7B4: ORAB #8
D7B6: LD7B6 ORAA #$C0 ; 1100 0000
D7B8: ORAB #1 ; BIT 0
D7BA: STAB L0006
D7BC: BRA LD7C2

D7BE: LD7BE LDAA L000D
D7C0: ANDA #$BF ; 1011 1111
D7C2: LD7C2 STAA L000D
D7C4: LDAB L0072
D7C6: BITB #2 ; BIT 1
D7C8: BEQ LD7DD



Code: Learning Disassembly Assembly

[jim_in_dorris]

I'm not sure if I see it correctly myself, but it looks like this is highlighted. If I may.



LDAA #255
D777: LD777 LDX #$D312 ; ACCEL ENRICH vs Diff TPS TBL
; Contrib vs Diff TPS TBL
D77A: JSR LFAD7 ; 2D LK UP ;
D77D: LDAB L00DF

LDAA and LDAB are Load Accumulators A and B.
LDX is Load index register X.
and JSR is Jump to subroutine.

What that piece of code is doing is loading accumulator A with $FF(256), loading the index register X with the address of the routine it wants (ACCEL ENRICH vs Diff TPS TBL)
then jumping to that subroutine to do a lookup. on return it then loads the B accumulator with the contents of $DF which is a status flag most likely. I'm not looking at the
hac of whatever piece of code that come from, but I feel confident that is what is happening

[1project2many]

Mark, working with assembly is kind of like working with a young child. You have to spell out every instruction to get a job done. To the processor, memory locations are mainly for storage. The accumulators are used for doing math operations or a few other larger instructions. If memory is like a storage shelf, then the accumulators are the workbench. Load accumulator means "get this thing from storage and put it on the bench." The instruction by itself doesn't do much. It's the steps that follow it that really do work. In the code section above D77D loads Accumulator B with a value from memory location 00DF. The next line is where something is done... in this case one of the bits is "set" or forced to be "1". Follow the BRA (branch) to the address it specifies and you'll see that the value from Accumulator B is then moved back to location 00DF with a "STAB" (STore Accumulator B) instruction.

[gregs78cam]

.....the accumulators are the workbench.

HAHAHAHAHA, story of my life.:innocent2:

[jim_in_dorris]

1project2many that's a nice analogy. I'll have to remember it. Unfortunately, I don't get to tutor many people in assembly anymore, everybody wants to learn an object oriented programing language.

[EagleMark]

I'll bet you could have a full class here!

Although I understood Jim, the analogy given by 1project2many made me look at it differantly, both accomplish the same thing. It's taken a long time to go througn ASM files to be able and add paremeters (stogage shelf) to the XDF files. But after that it's taken a while to find them and what they are doing with them (moved to accumulater). Then jumps to subroutines which could be a lookup? Stabbed in place as a vaule that is used... in general.

I've got more from your guys 2 posts then hours of searching and reaeding for what/why how...

Please go on, there's a lot more commands there, some may be coming together. I'll take a guess ADDA is add A? ANDA is and A? CLRA is clear A? LSRD Load Sub Routine? BEQ? BNA?

[jim_in_dorris]

A really big help might be to download the microsoft pink book for the 68hc11 microcontrollers. The book has a section with all the instructions and their variations.

http://www.technologicalarts.com/myfiles/links.html

you want the reference manual. it's the 3rd link down and is a pdf.

It is loads of help. if you want, we can actually start using this page to walk thru sections of code, it's also good for me to practice a skill I don't get to use except here.

One big problem I have is using the editor on this page and formatting code, I guess I will have to edit it in HTML to get it to look right. Using the scroll box like you did is an excellent way to insert code, but when you want to comment on what is happening, you probably need to do it in this editor, hence the HTML.

[EagleMark]

If you click reply and then advanced there is a [Code] [HTML] and other options instead of just the [quote] available in Quick reply.

You can paste in code and then comment.

I'll take a look at those links. Learning way around them helps, but most everything we need is already done and available. Need to get a 0411 LS ASM...

[1project2many]

Jim,
I had a huge problem with OO programming. Having taught myself basic, cobol, and the smallest amount of TI's assembly in the days when arcade games were new and security wasn't much more than a two letter password, I just couldn't grasp that object oriented programming isn't about the language. It's about organizing and structuring the resulting code. To make matters worse, I was learning OO along with C++ which really made it tough for me to recognize the difference. C and C++ are so closely related after all that solutions always seemed to present themselves to me long before I'd worked my way around to the OO lesson being presented. It took a year or so after the last class for me to catch on. Overall it can be a much better way to structure large programs but for ones it always feels like an unnecessary level of complexity.

Mark, the Motorola "Pink Book" (the cover of a real copy is pink) contains all the rules for HC11 assembly code. It's dry reading. Trying to read it and memorize the contents takes a much different mind than my own. What I found effective was to grab a chunk of code and a disassembly that was already partly commented and see about matching up the instructions, comments, and the code. There's an index for "instruction set details" that is going to be your favorite place to hang out. Every instruction is there along with all relevant information for that instruction. Get used to using search in your pdf reading software. You'll need it frequently.

Before talking about what the actual instructions are, it's probably helpful to give you some expectations as to what you'll see when working out a disassembly. System control programs are really about making decisions then acting on them. This process is very easy to see at the assembly language level because there just aren't many other options. Using the instructions above it doesn't take long to find a great example of this.




D7AE: LDAA L000D
D7B0: BITA #$40 ; BIT 6
D7B2: BNE LD7B6
; ...... else
D7B4: ORAB #8

These four lines make a decision and act on it.

Load the value from memory location 000D.
Check to see if bit 6 is a "one"
Run the code starting at D7B6 if it's not,
or set bit 3 in the data stored in accumulator B if it is.

These patterns of "get, check, do" occur over and over and they are how the ecm reacts to sensor input. If you're going through a disassembly these tests are what you're looking for. Sometimes they're short and sweet like above. Sometimes you'll read many, many lines of code before you can see the complete test. But these are what the code is all about.

Now for the actual question:

Please go on, there's a lot more commands there, some may be coming together. I'll take a guess ADDA is add A? ANDA is and A? CLRA is clear A? LSRD Load Sub Routine? BEQ? BNA?

ADD, AND, CLR, and LSR are all ways for the processor to manipulate data. ADD sums two numbers and CLR replaces a number with zeros. AND and LSR are logical operations. LSR is a logical shift right. If you have a byte that looks like this: 11100111 , performing an LSR would turn it into 01110011. Imagine zeros moving in from the left and pushing everything else to the right. AND can be tricky. It's a way to set or clear bits in a byte using a comparison. AND will compare two binary numbers and put the results in a specific location. If a bit is one in both numbers, it will remain one. If a bit is zero in either number it will be set to zero in the result.

BEQ and BNE are decisions. They can result in branches in the code. "If this is true, start running code at a new location." BEQ is Branch if EQual. In it's purest form it's found after a CMP instruction although there are plenty of ways to use it without a CMP (such as after BITA). BNE is just the opposite. Branch if not equal.

The conditional branch instructions like above can be the most complex to get a handle on. There are a lot of rules to understand. For example, I could add 1 and -1, follow them with a BEQ, and the code would branch. You'll see conditional branches used in strange ways and there's usually a darn good reason if you can get to it.

[RobertISaar]

now that its been mentioned... i actually chopped off everything before and after the instruction set and made a new PDF out of it...

might be useful. i generally only have to look at it when BCC or BCS instructions come up... they have corresponding BLO and i think BHS "alternatives", it's sometimes easier to think about when a compare is done in terms of "lower" or "higher/same" instead of "did the carry bit get set"?

sometimes, you'll see a load, immediately followed by a BCS/BCC, which confused me for a long time.... i wasn't sure how the carry bit could ever get set from simply loading an accumulator... turns out, when loading an accumulator, the carry bit can be set based on the most significant bit of the byte loaded.... it's normally used to simplify the code a little bit to prevent an unnecessary compare being done when you have 2's compliment values(i think that's the only time i see it).

[jim_in_dorris]

1project2many, you actually sound like you would make a good teacher, your explanations are clear and concise. I understand your problem with oop's. I actually learned IBM360 assembly first, then moved to 6502 assembly and a few others including Z80 and early motorola chips while learning pascal, basic, fortran, and some military specific languages. My first exposure to object oriented lanugages was ADA when I was working on the space shuttle as a programmer. Talk about not getting it. LOL.

Robert, I wish I had that pdf before i printed out the entire pink book and stuck it in a binder. Good idea.

I think that one of the biggest problems with trying to duplicate disassembly in an ASM file is the addressing modes, and how to force them. When I went thru the $42 code (ASDU and ASDX with hiway cruise and ECS test disabled) in Dec., forcing a particular addressing mode to make certain that the ASM file matched the BIN was about 1/2 of the work of getting the ASM file correct.

[EagleMark]

Force them? 1project2many said this was like children, instruct them? :laugh:

Wow 2 differant teachers!

When I first started looking at ASM files all I was intrested in was the memory loactions so I could add things to XDF. (Correct, memory?) Then it started sinking in that memory was not always the answer because of accumulaters... but really the workbench was where I needed to be... just a few hours after a couple posts from you guys and it's all making sense (although got very complicated).

I don't want to slow you guys down... but... is there a point I have to start trying to use a dissasmbler and assembler again? First shots were horrible... and what to use? I've read about a lot of programs, some won't even run in windows. Why does no one recomend TunerCat dissasembler? Seems to be designed for these?

When I learned HTML/CGI etc needed for websites I did it the old fasion way, typing code in notpad. WYSIWYG made things go faster years later but many times I could type in the code I wanted faster then finding the right button. Glad I actually learned it and not how to use a software program.

Making cars run better is my intrest, I'm more intrested in data coming out of car, back to this, I need to know why and how? I've tempted this a few times before and backed away because of the learning curve and time. But it keeps coming back as software just does not have all paremeters and sometimes I need to know how they work. $42 started like any other mask, just the basics, now it has more paremeters then LT1 $EE, Vortec 96, 97 98-00. Heck it's got stuff I'd like to use in my LS 0411 PCM that has not been included in expensive tuning software! WIthout a ASM, I can't add things! So I'm back here again, always seemed to get away from this because of available ASM files and learning enough how to find and add what I need.

Back to Vortec for instance, everyone siad it can't be tuned right? Well I found dimented247 98 vortec ASM and guess what? All the missing paremeters are there! No on'es ever put them into a mask. This is my real goal! Masks!

Direction/suggestions?

[1project2many]

"Who is that masked man??"

There are only a few reasons to grab the disassembler. 1) You can't find an existing disassembly. 2) You want the experience. 3) You want to make a disassembly that can be reassembled later. Most people will never need get to the point where they're trying to reassemble code but you won't need to ask if you get there.

Adding items to an XDF is easy of course. Naming them correctly is tougher and getting a correct description of what they do takes even more time. Often you'll need to be able to step through the lines of code to see just what a value is for. An "upper closed loop tps limit" could be used several different ways and without reading the code you're not going to know which is correct. Sounds like you've run into this already.

Jim's talking about trying to reassemble code from a disassembly. The ASM file is what's used as a template for the assembler. Addressing modes refer to how the processor gets data from memory. If you don't get the right mode the processor looks in the wrong place.

I'm not sure why no one recommends the TC disassembler. I don't because I think there are more powerful tools. I like the old Dewtronics tool that I've posted here (code seeking disassembler). It's easy to use and was employed by a well know player on the market for a while. IDA Pro is good in a different way. It can format code, mark jumps and branches for easy tracing later, and does a decent job with labels. It's also expensive.

Jim, thanks. We've had a lot of newbies here in the shop and because I work for a company that handles special needs children I frequently have a "work study" kid here as well. If I can't teach them what needs to be done, I end up doing twice as much work myself. So I use my experiences with good teachers from my past in order to do what I do. Plus, there's the magic of proofreading and editing here. ;)

What are you using for an assembler? Does it have operands to force addressing modes? Will it adhere to your commands?

[RobertISaar]

FWIW: i don't use an assembler... i disassemble a LOT of stuff though.

the tunercat disassembler..... i've only ever had bad results with. i might not be setting it up correctly, but i seem to remember it liking to turn everything in the BIN into an instruction.... no calibration left.

IDA..... sweet zombie jesus does it make things 10,000X easier than the simple "pass, pass, pass, spit out ASM file" disassemblers... there's nothing wrong with those, but IDA allows for you to look at so much more information at once, it's easier to "link" things together. i generally don't use a "template" in IDA since it definitely doesn't work well with the P4s, works with the P6 units since they are full-fledged 68HC11F1, not the P4 where it's an offshoot of another variant.

[EagleMark]

It's a little late to start doing OBDI as most are done. $EE was left in the dust with the Vortec, but they are newer P6 correct?

Right now I am OBDII software poor so I don't see getting IDA.. Ha! For websites I still use a 2004 copy of Dreamweaver, but I can type whatever it cant... and about same year Adobe Photoshop which has always been more then I need for websites. They both still work in WIndows 7.

LS 0411 is what's needed right now and the 2002 OS 12212156 would cover any conversion and can be flashed into any 0411 PCM, seems to be where future is right now. It would cover the next 10 years... then I don't think there will be a standard cure all replacement?


Adding items to an XDF is easy of course. Naming them correctly is tougher and getting a correct description of what they do takes even more time. Often you'll need to be able to step through the lines of code to see just what a value is for. An "upper closed loop tps limit" could be used several different ways and without reading the code you're not going to know which is correct. Sounds like you've run into this already. I've got several years into $42, adding, fixing, tweaking and correcting. It's amazing that anyone could have got a motor running right let alone tweaked to efficency with what I started with!

Been adding discriptions and notes to paremeters after double checking ASM and field test on vehicles, been well worth it as it has transfered over to everything else. Even now working on $0D I go back to my notes in $42 for descriptions, check ASM, check vehicle and add them. I've been on the edge of releasing my personal $42 for months. Jims new ASM stopped me and I found more stuff wrong, then added the ESC and HiWay Lean Cruise patch stuff correctly. It's really a history lesson and tuners guide now!

The closest thing I have ever seen that is complete would be $0D stuff, even then not much for tips or tuner instuctions, let alone all the tricks of TunerPro installed... BTW I just fixed all the history tables in $0D and added some data tracing, simplified the catigories, added new item lists to adx to see usable info instead of all info, all infor item lists are still there... I'll bet I have 20 hours into it!

[jim_in_dorris]

1Project2Many, What do you do that you work with special needs kids? My daughter has been a special Olympics coach for years and loves it, I admire people who can give so much of themselves to those who need it the most. I use the MGTEK asm11 assembler, it works great for me. As for forcing address modes, I want to spend a little time putting together a little primer on why and how I do that. I am sure that you understand it quite well, but for everyone else, it may shed some light on the subject. I intend to work on it and have it ready for the weekend.

Mark, I really like the $0D mask myself, and have probably 2-300 hours invested in formatting my copy, looking at what the code is doing, and in general, just trying to understand it. If it was easier to get into, and cheaper, I would be jumping all over the 411 stuff you guys are playing with. If I ever get to start my 58 Jag street rod project, I think that the 411 will be in the mix.

[EagleMark]

Mark, I really like the $0D mask myself, and have probably 2-300 hours invested in formatting my copy...I thought I was a nut job for admitting all the hours I put into this stuff, but actually I enjoy it! More importantly because in the end I can make vehicles run better. It's always been my first goal and still an end goal.

Looking forward to continuing this, strange that since this thread started I've actually had to much work for a change.

[Six_Shooter]

I'm going to have to read back through this again, see if it helps.

I started reading the Pink Book a number of years ago, got about 10 or 12 pages in, set it down (closed the file) with intentions of getting back to it and never did. :/

I'm currently taking C++ right now, and C last semester, it still hasn't clicked yet. I understand bits and pieces, but not as a whole, and not as well as I need to.

This summer will be dedicated to learning the intricate details that I know I won't get before the end of the semester, without some sort of miracle.

Once school is done, I plan to get back to learning to disassemble, and how the machine code works. Coincidentally, my C++ programming instructor was talking about machine language this morning, and how we might encounter it in our future careers.

[jim_in_dorris]

Six_Shooter,

Back when I was coding in C, we would frequently output the C code as assembly to optimize the code. Fortunately, I was really familiar with assembly so it was no problem. C (and C++) are a little tricky to get until you spend a lot of time writing code, then it clicks. I think that one of the problems with teaching people how to use a particular language is that you don't have a real application that you are coding (this is not always true, but mostly) If you really want to learn to code, write actual programs like a browser, or text editor. Good Luck in your programming class.

[1project2many]

I'm currently taking C++ right now, and C last semester, it still hasn't clicked yet. I understand bits and pieces, but not as a whole, and not as well as I need to.

There usually isn't a lightbulb moment when learning coding. Don't expect that all of a sudden the big picture is crystal clear because it's not like that. Programming languages are nothing more than a set of rules with the actual instructions and commands being tools used to accomplish a job. The goal is to make stuff happen using those rules. It takes time to learn them, and more time to get good at using them. You can read about a wrench all day long but you won't develop that instinctive knowledge of what you and the wrench can do together until you pick it up and try to do something. And in the same line of thought, it's highly unlikely that you'll become Programming Buddha without spending crazy amounts of time writing code.


If you really want to learn to code, write actual programs like a browser, or text editor.
Exactly. I've never learned a language only by following little lessons out of a book. I always learn the most by deciding I want to solve a problem then setting out to write code to solve it. Write a million little programs. Find ten different ways to solve the same problem. Get bored and try to challenge yourself to write the most complex code to add two numbers. Take a section of GM assembly code and try to duplicate the functions exactly in C (try duplicating an eight bit multiply operation on a 16 bit value with proper rounding, keeping all the values in hex!). Grab code snippets off the internet that seem interesting and try incorporating them into a program... then troubleshoot them when they don't work.

And don't hesitate to ask questions here. ;)

[EagleMark]

Moved my 10 degree issues to my 10 degree disaster thread to clean up this code thread...

[Playtoy_18]

Subscribed,great descriptions.
I'll post when I start understanding it.



Making cars run better is my intrest, I'm more intrested in data coming out of car, back to this, I need to know why and how? I've tempted this a few times before and backed away because of the learning curve and time. But it keeps coming back as software just does not have all paremeters and sometimes I need to know how they work.


Describes me to a tee,though you are furthur along than I am.
I have written a hello world program though :)



We've had a lot of newbies here in the shop and because I work for a company that handles special needs children I frequently have a "work study" kid here as well.

off-topic,pm if you like.
Just curious what type of special needs if I can ask,I've got two here at home :)

[34blazer]

BUMP! just skimmed this at work(at least im doing something constructive on the payroll!), and added to my faves.

1project2many,
Hi Shannen, didnt realize that was you LOL

[1project2many]

Awww, dangit. Now my cover's blown.

[daleulan]

I started with learning 6502 assembly on an Apple-IIe. I designed and built a hard drive controller for it, and even a copy-protection scheme. So when I started, assembly code was the first thing you learned. I did some work for a small-ish data modem company in Calgary on the 68HC705C8 and it was very similar to the 6502. After that switching between any assembly code in the Freescale/Motorola line - or the 6502 - was no problem regardless if it was a data decoder or an engine controller. I did one engine controller in 68HC11 assembler (ground-up design, 30k of code and calibration), and at about that time I started disassembling GM and Ford ECM code. Ford was harder since it was an 8096 but I managed to get through it. Now my code is mostly written in 'C' but since it is on a 9S12X part I have a lot of assembly language macros that I use for efficiency. That will not be much fun to port into a 32-bit processor but it works fine.

Anyways, one thing that I did a lot of to learn how an algorithm would work was to download the code to an evaluation board, then single-step through it. I think now you could use a simulator. The other thing I found was important was to figure out what are I/O locations on the board and datastream locations in the communication section. Getting those figured out allows a fast decode from there. On the OBD-II code I start with attacking the mode 1 data (generic data) because that gives you things like O2 sensor voltage, MAF, MAP, etc. Then you can track down what the code does based on its function. One acid test for a disassembly is try to reassemble it and get the same image. If you do, that's good. next, add one 'NOP' at the start of EPROM and offset the code by one byte and make sure it still runs! Do the same with calibration and also with RAM. If your disassembly is correct the code will run with each of those changes. Then you can make changes to the code. I did that with the Diesel 6.5L TD code. It was a lot of work but I fixed some bugs that were in that code base. Some of these sort of hints would apply after you get a bunch of the way there. The OBD-II code, BTW, is very interesting but it is massive. The newer ones (MPC556x) have massive amounts of code in them and are generally programmed graphically (Simulink/Stateflow) and calibrated using automated tools (CAGE). I would hate to try looking at the assembled code.

[brian89gp]

I see references to "initalize the stack". A lot of times on the masks I look at it is initialized to $01FF. First, what is the stack? Second, what does it mean and do to initalize it?

[1project2many]

Stack is a "reserved" space in memory used to store information for processor operation. It's different from regular memory because the processor generally determines how to use it, not the programmer. For example, when a JSR instruction (Jump to SubRoutine) is encountered, the expectation is that the processor will stop what it's doing, run a temporary job using code at a different address, then return to the original job and pick up where it left off. The processor stores information on the stack needed to resume the original code before heading off to the subroutine.

This memory is called a stack to give a nice graphic image to work with. Imagine a stack of dishes. As you add to the stack it grows. As you take from the stack it shrinks.

The stack is initialized when the processor is given an address to use for the first memory item. Once you set that first plate down, that's where the stack will be. In the 6811 the stack will "grow" down. IOW each new item added to the stack gets a lower address than the previous item. If the stack is initialized too close to the lowest accessible memory address, you will not have a large enough space to pile your plates and you'll end up with problems. Careful programmers will often "clear" the stack or set all memory values to zero in addition to setting the initial address. Some processors have a single command to clear the stack. In the earliest GM disassemblies you'll sometimes see an actual code loop that writes zeros to each location in the stack. Either way, this helps ensure you're not going to randomly read incorrect data somewhere in the program.

[brian89gp]

Initalizing at $01FF makes sense then, it is the highest RAM address in the ECM's I'm looking at and would grow down from there. How do you determine how deep the stack can get? Count the nested JSR and similar?

Second question(s). I know about the main segment loop and how it is called based off of a interrupt from a timer. What happens if it is still in one of the loops when the next interrupt comes, for example if you add too much code and it doesn't complete in time? What happens when a loop finishes before the next interrupt?

The main segment loop seems to be mainly the measurement and calculation of values and the output of those values (ignition and injection events) are driven by other interrupts seperate from the main segment loop? How do I determine how those are called, and which part of code is called? Or do I have it all mixed up and it works differently?

[RobertISaar]

i determine how far the stack gets by transmitting addresses near the end of the memory map via ALDL. if the values always stay 0, the stack hasn't reached that far. if they change values at any point, the stack has reached that far.

if one loop doesn't finish before the next is set to begin, a couple of things happen.... in all code i've seen, there is a flag that will get set when that event occurs, but it is entirely informational, it won't effect the operation of the code. when an interrupt happens though, A, B, X, Y the CCR, stack pointer and program counter all get stored to the stack, that's 11 bytes. when the RTI instruction comes up, those get pulled back off and the processor resumes what it was doing before the interrupt. if the stack gets reinitialized, then all of that data is lost. incidentally, the interrupt code for the 160Hz timer reinitializes the stack every time it comes up. in A1, the address of FFF2 shows A21F, so the code jumps there. byte 100 is checked to see if bit 7 is set, can jump around depending on why the timing interrupt was called, but if it was due to the 160Hz timer code, then it LDS 1FF to clear the existing stack.

[brian89gp]

Is there one timer interrupt, or many timer interrupts? I am assuming that the 160Hz timer is for the main segment loop?

If I understand correctly, if a loop is interrupted and the stack is reinatlized it just keeps moving along with the next segment in the sequence? Since the main segment loops only really measure and calculate the worse that happens is something doesn't get updated to a more current value and since each segment of the loop runs 10 times a second this is no big deal since it will just be done on the next time the loop is ran?

Ignition, injection, and what else? I assume these are ran on an interrupt to be sure they happen at the correct time, and they take priority over the background main segment loop processing? What all runs on these interrupts? Where do these interrupts get defined/called? I sort of followd your last paragraph but not fully understanding it.

[RobertISaar]

with the P4 processors, there is one vector for internal interrupts. at the vector location, there are a few paths that the code can take, depending on what caused the interrupt. some of them are for ALDL (when the receive data register is full or the transmit data register is empty) or to update the SCI controlled outputs or to deal with the 160Hz timer. it would appear that when both 4007 and 4008 bit 0 are set, that indicates that the 160Hz timer caused the interrupt. so the code loads $CD to the A register and then adds the value of the timer at 4006 to it, and then stored to 4006. this timer is continuously incremented and when the timer runs up to the new value, an interrupt is generated. $CD is equivalent to a period of 0.006256103515625mS since the timer counts at a rate of 32,768Hz.

the 160Hz timer is used mainly to determine which code to execute in the loops that exist. most P4s tend to have 1 or 2 loop tables and you'll see the timer pulled immediately before looking up which code section it jumps to. the value will have an AND operation done to it to create a value that could be anything from 0 to 160 to being 0 to whatever number of possibly code locations it will jump to.

and your understanding of how the loops work is correct. it's kind of a neat system but if something doesn't make it all the way through the first time, pretty good chance of it not making it through the next time since it will be roughly the same processing time required(with variables being other interrupts).

ignition and injection are dealt with when the external interrupt code runs. one of the possible external interrupts are the 3X(or 2X or 4X) reference pulse. injection is pretty simple with MPFI, since nothing really needs timed, just when an interrupt happens, inject for x time. i haven't looked for the section of code for it, but i assume that there is a section of code that indicates the number of reference pulses before another injection event takes place. there is also the possibility that the reference period is used to estimate the amount of time between injection events need to happen and then an interrupt is generated there. with ignition, timing is critical so there are more registers to deal with it. the code turns a crank angle into crank time, so when a ref pulse happens and the code knows that the pulse happens 60* before TDC(for example), it takes the desired spark advance, turns it into "how long before the spark needs to happen", then subtracts time out for the dwell period, then creates "how long until EST circuit needs to go high to start dwell" and "how long to dwell to make plugs fire when desired".

with the P4, there are still a lot of unknowns. with the P6, being a standard part(68HC11F1) everything stated in the pink book is accurate.

yes, there is some prioritization when it comes to interrupts, the pink book describes them, though only some will apply to a P4.

what runs on an interrupt: the absolute bare minimum that will do the function the interrupt needs to do. when an interrupt is being serviced, other interrupts are disabled and it takes away from processing time that could be used to execute other code. fat interrupt code will cause problems.

[brian89gp]

What is the GM HUD? Some sort of code debugging hardware that plugs into the card edge connector? I see that $5000-$6fff and $0400-04ff addresses are for the HUD, if the HUD is not plugged in are these addresses usable? I seem to remember something about any write to a certain address space will cause a reset but can't remember the range.

I also seem to remember that the 3x3 grid used for the BLM cells are stored by battery backed RAM. Where are these in the address space, is some RAM battery backed and others not? I could just be remembering all of this wrong too.


what runs on an interrupt: the absolute bare minimum that will do the function the interrupt needs to do. when an interrupt is being serviced, other interrupts are disabled and it takes away from processing time that could be used to execute other code. fat interrupt code will cause problems.

That makes sense.

[RobertISaar]

GM HUD = connected to edgecard connector, code tends to write a lot of values to it that would be useful to view while doing the initial calibration to a vehicle.

5000-5FFF is HUD ROM, 400-4FF is HUD RAM.

read OR write to the 6000-6FFF area will cause a reset, IIRC. i need to test this though. i was planning on using the area for basically "scratch" space to allow anything to be written in it that isn;t necessarily needed by the processor to operate the vehicle(like revision info, etc).

if the HUD isn't plugged in and you have RAM or ROM mapped to the area, you can use it however you want.

BLM cells..... depends. some only have a total of 3, while others are 16 or 16X2(CCP and non-CCP) or anything in between. i would ASSUME they would all be stored in the battery backed RAM, all of them that i have looked at seem to be.

in a typical P4, 00-FF is battery backed and 100-1FF is not. however, there are special P4s out there, ones that map RAM all the way out to 3FF, those MIGHT have more battery backed RAM. there could be more P4s too. i seem to remember the 4.5/4.9 cadillacs having some out of the ordinary hardware.

[brian89gp]

P4 vs P6? 8 vs 16 bit?

[RobertISaar]

they're both 8 bit.

in terms of guesswork, a lot less is needed with a P6.