A sample debugging session with MINIMON

[chysn]

Code: Select all

            bit $f15e       ; $00 in KERNAL ROM
            beq one

That doesn't work as intended, as the branch is always executed.

Uh... yeah, now that you mention it. Wouldn't this be an issue with Butterfield's routine, too?

Update: I was looking at his comment, not his code. The correct value is $05, so that would be changed to

Code: Select all

bit $f0e5 ; $05 in KERNAL ROM

[Mike]

I was looking at his comment, not his code. The correct value is $05, [...]

The OCR probably choked on that one.

[chysn]

28 bytes, i.e. same size but it preserves both the A and Y registers.

Would it have killed Chuck Peddle to give us an Immediate Mode BIT instruction?!

[Mike]

Would it have killed Chuck Peddle to give us an Immediate Mode BIT instruction?!

There is one in the 65C02 (opcode $89), but that one and the other extra instructions that come with the 65C02 would in turn require a redesign of SizeOf ...

[chysn]

Would it have killed Chuck Peddle to give us an Immediate Mode BIT instruction?!

There is one in the 65C02 (opcode $89), but that one and the other extra instructions that come with the 65C02 would in turn require a redesign of SizeOf ...

I had to know, so I checked the 65C02 opcodes against our routine here. There are only two 65C02 instructions that break the 6502 patterns. STP ($db, Stop) is an implied instruction, but the routine returns 3. WAI ($cb, Wait for Interrupt) is an implied instruction, but the routine returns 2. Everything else works already; even the new Indirect Zero-Page addressing mode (which is an awesome addressing mode) returns 2 for all its opcodes.

I'd stare at bit patterns for a while again to see if STP and WAI can be accommodated within four new tests... but I don't want to.

[Mike]

These days, I checked the small instruction length determination routine developed by chysn against the opcode decode routine in MINIMON, and sure enough, both return the same results for all 151 documented opcodes of the NMOS 6502.

As a follow-up, I devised the routine below (download) to adjust all 16-bit addresses within a relocated piece of code. ptr/limit 'bracket' the (already) moved copy of the code in question, start/end bracket the address range of the operands that are supposed to be adjusted, and offset contains the amount to adjust by (use 2s-complement to subtract addresses):

Code: Select all

; ** simple 6502 relocate tool
;    written by Michael Kircher

; $55/$56: pointer (current instruction)
; $57/$58: limit
; $59/$5A: start of range
; $5B/$5C: end of range
; $5D/$5E: offset
; $5F/$60: instruction operand (16 bit address)

.02A1 LDY #$00
.02A3 LDA ($55),Y  ; load instruction opcode

.02A5 LDX #$03     ; determine instruction length (courtesy chysn)
.02A7 CMP #$20
.02A9 BEQ $02C1
.02AB BIT $C3B9    ; #$08 from VIC-20 BASIC ROM
.02AE BEQ $02BA
.02B0 BIT $C01A    ; #$05 from VIC-20 BASIC ROM
.02B3 BEQ $02BF
.02B5 BIT $C50E    ; #$14 from VIC-20 BASIC ROM 
.02B8 BNE $02C1
.02BA BIT $C01E    ; #$9F from VIC-20 BASIC ROM
.02BD BNE $02C0
.02BF DEX
.02C0 DEX

.02C1 CPX #$03     ; 3-byte instruction?
.02C3 BNE $02ED    ; No, skip.

.02C5 INY          ; copy operand to $5F/$60
.02C6 LDA ($55),Y  ; and compare with start of range
.02C8 STA $5F
.02CA CMP $59
.02CC INY
.02CD LDA ($55),Y
.02CF STA $60
.02D1 SBC $5A
.02D3 BCC $02ED    ; lower? Then skip.

.02D5 LDA $5F      ; compare copy of operand
.02D7 CMP $5B      ; with end of range
.02D9 LDA $60
.02DB SBC $5C
.02DD BCS $02ED    ; higher or same? Then skip.

.02DF DEY          ; add offset in $5D/$5E to
.02E0 LDA $5F      ; copy of operand and adjust.
.02E2 ADC $5D
.02E4 STA ($55),Y
.02E6 INY
.02E7 LDA $60
.02E9 ADC $5E
.02EB STA ($55),Y

.02ED CLC          ; advance to next
.02EE TXA          ; instruction
.02EF ADC $55
.02F1 STA $55
.02F3 BCC $02F7
.02F5 INC $56

.02F7 CMP $57      ; current pointer still lower
.02F9 LDA $56      ; than limit?
.02FB SBC $58
.02FD BCC $02A1    ; Yes, continue.
.02FF BRK          ; return to monitor.

The routine just happens to fit barely into the 95 bytes available in $02A1..$02FF. With TAY/TYA instead of BIT in the instruction length determination routine, at address $02C5 the Y register would have needed to be reloaded with LDY #$01 instead of INY, exceeding the available budget by 1 byte.

Now that we've got the solution, we only need a problem.

Cheers,

Michael

[chysn]

I like it!

Since you only care whether it's a 3-byte instruction, and not how many bytes the instruction has, you can probably do without the early LDX #$03, the DEXes, and the CPX #$03, then just send the 1- and 2-byte branches right to the "advance to next instruction" code.

There's probably even a way to identify 3-byte instructions with fewer tests.

[Mike]

You need the instruction length in X also for the 1 or 2 byte instructions so the tool can correctly 'step' along the code, see the TXA at $02EE.

[chysn]

You need the instruction length in X also for the 1 or 2 byte instructions so the tool can correctly 'step' along the code, see the TXA at $02EE.

Oh right, of course. This would make a cool assembler tool.

[Mike]

Oh right, of course. This would make a cool assembler tool.

It retrofits the 'New Locator' facility of VICMON or HESMON back into MINIMON, as transient tool. Or into wAx.

I have put a corollary about "BIT #imm" into the sticky thread "ROM calls and other tricks".

[Noizer]

Oh right, of course. This would make a cool assembler tool.

It retrofits the 'New Locator' facility of VICMON or HESMON back into MINIMON, as transient tool. Or into wAx.
(...)

What‘s the „New Locator“ facility of Vicmon and how is it to use?

[Mike]

What's the "New Locator" facility of Vicmon and how is it to use?

Please look up section 2.3.12 (N - NUMBER) in the VICMON manual, on page 8.

[Mike]

Now that we've got the solution, we only need a problem.

... or not a problem perhaps, but at least a workable example.

Here's a small routine that installs an interrupt server to change $900F (combined background and border colour) every 1/60 second. The original was placed at $033C, but now, for some reason, we'd like to have it at $1800: (download example.prg). Do a LOAD"...",8,1 and try out with SYS828 to see what it does. After we have started up MINIMON (or another monitor), let's take a look at the program!



When this routine is supposed to go to $1800, we need another 16 bit value put into the interrupt vector at $0314, obviously ...



... but besides this, we're quite lucky: no jumps to relocate - but wait! What's with that BIT instruction at $034B?

The absolute operand of the BIT instruction is read off by two LDA instructions that provide low- and high-byte for the IRQ vector!

This looks like someone wanted to assist the relocator. Here, the BIT instruction is just a placeholder for the IRQ vector address, and when the relocator encounters it, that address will also be corrected! This would not work if the IRQ vector value had been placed into immediate operands of the two LDA instructions, which is a common reason relocators fail.

That being noticed, proceed! (download relocate.prg)



The monitor Transfer command T 033C 0353 1800 makes a copy of the code at the new place. With D, we inspect the copy and see that the instructions at $1801, $1807 and $180F still point to the original addresses. Now we provide the relocator with a pointer to the begin of the moved code, $1800, which is put into $55/$56.



In the same fashion, we instruct the relocator to stop at $1818 (limit address put into $57/$58). All 16 bit operands between $033C (start address, put into $59/$5A) and strictly less than $0354 (end address, put into $5B/$5C) are supposed to be adjusted ... by $14C4 = $1800 - $033C! Therefore, we put $14C4 as offset into $5D/$5E, start the relocator with G 02A1 ...



... inspect the copy once again with D 1800 1817 and see the instructions at $1801, $1807 and $180F now have their operands corrected: the two LDAs read the IRQ vector address off the BIT instruction at $180F, and its operand correctly points to the INC $900F at $1812.

We delete the original code with F 033C 0353 00 and exit to BASIC with the X command.

SYS6144 runs the relocated IRQ routine.


P.S. It's quite instructive to compare this method with the approach taken in the thread 'IRQ Installer'.

[chysn]

I may have missed this somehow, but where is RELOCATE.PRG?

[Mike]

I already linked to 'relocate.prg' in an earlier post in the thread, but nonetheless replicated the link in my latest post.