Code header
Files have load and execution addresses that specify where they are loaded to and executed. These specify I/O memory by being &FFxxxxxx and language memory by being <>&FFxxxxxx. The I/O processor is always a 65x2, but the language processor can be one of many CPUs. Files can have a header which specifies what processor the code is written for so if it is run on the wrong processor the client code can generate an error.
The header is the same as the ROM header as ROMs also need to specify what CPU the code is written for and where the code should be copied to in the language memory. The code header also allows files to be loaded from filesystems that don't have load/exec addresses, such as DOS/Windows.
Header
The general layout of the code header is the following:
Start+0: JMP Entry ; Code entry address or entry point
Start+3: JMP Service ; Service entry point if a ROM
Start+6: EQUB ROMtype ; Code type byte
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Version number and Title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string (optional)
Copyright: EQUB &00:EQUS "(C)J.G.Harston" ; Copyright string
EQUB &00
Reloc+0: EQUD Start ; Load address if ROMtype bit 5 is set
Reloc+4: EQUD Offset ; Offsets if specified by the ROMtype
etc: .... ; Possibly other data
...
ALIGN ; If the code needs to be aligned
Entry:
The title, version and copyright strings should be formatted as shown. The binary version number should be either &0x for version x.yz or &xy for version x.yz.
Theoretically, the copyright offset can be any value up to &FF, and the copyright string can be any length, resulting in the relocation addresses being at any arbitary distance from the start of the file. In practice, the header should be written so it fits into a maximum of 256 bytes.
ROM type byte
The ROM type byte at Start+6 indicates what CPU the code is written for.
bit 7 - Service entry for ROMs, ignored when loaded
bit 6 - Contains code, if clear will generate an error similar to 'This is not a language'
bit 5 - Contains a relocation address, if clear the code loads to &8000
bit 4 - Electron key expansion
bit 3-0 indicates the CPU type:
0 6502 BASIC 4 - 8 Z80 12 80286
1 Turbo6502 5 - 9 32016 13 ARM
2 6502 6 - 10 - 14 -
3 6800/6809/68000 7 PDP11 11 80186 15 -
Code in a ROM will normally have a ROM type byte of &E0+cpu, code loaded from a file that is not also a ROM image will normally have a ROM type byte of &60+cpu. If the ROM type byte is &40+cpu or &C0+cpu there is no relocation address and the code loads to &8000.
If the code is run on a CPU that does not match the CPU type an error similar to 'This is not Z80 code' is generated.
Some clients always expect the relocation data to be present even if bit 5 is clear, so a full header should always be used with the flag byte being &60+cpu or &E0+cpu.
Entry point
The entry point at Start+0 must be an unconditional branch to the code's start point in the machine code for the CPU. If the ROM type byte bit 7 is set then Start+3 contains the ROM service entry point, so the entry point at Start+0 must fit into three bytes. If the ROM type byte bit 7 is clear the code at Start+0 can be up to six bytes long, and some CPUs require this.
If ROMtype bit 7 is set then the entry point at Start+3 must be a 6502 unconditional branch to the ROM's service code, or a 6502 RTS.
The code is entered at the entry point with the registers set to a defined state. This is normally:
Primary register: 0=raw code (no header), 1=code with a header Secondary register: points to command line tail Flags: CC=entered at reset, CS=entered otherwise, eg a *command
Example headers
65x2 - ROM type 0,1,2
Start+0: JMP Entry ; Code entry point
Start+3: JMP Service ; Service entry point
Start+6: EQUB ROMtype ; flags+&00, flags+&01, flags+&02
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Binary version number and title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string
Copyright: EQUB &00:EQUS "(C)J.G.Harston":EQUB 0 ; Copyright string
Reloc+0: EQUW Start ; Load address if ROMtype bit 5 is set
Reloc+2: EQUW RelocateTable ; Normally 0, only supported by MOS 3.50
...
Entry: ; Code start
6809 - ROM type 3
Start+0: BRA Entry:EQUB 0 ; If position-independent code
or JMP >Entry ; If not position-independent code
Start+3: EQUB &4C:EQUW Service ; 6502 jump to ROM service handler
or EQUB &60:EQUW 0 ; 6502 RTS if no ROM service handler
Start+6: EQUB flags+&03 ; ROM type byte
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Binary version number and title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string
Copyright: EQUB &00:EQUS "(C)J.G.Harston":EQUB 0 ; Copyright string
Reloc+0: EQUD Start ; Load address if ROMtype bit 5 is set
...
Entry: ; Code start
PDP11 - ROM type 7
Start+0: BR Entry:EQUB 0 ; Branch to code
Start+3: EQUB &4C:EQUW Service ; 6502 jump to ROM service handler
or EQUB &60:EQUW 0 ; 6502 RTS if no ROM service handler
Start+6: EQUB flags+&07 ; ROM type byte
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Binary version number and title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string
Copyright: EQUB &00:EQUS "(C)J.G.Harston":EQUB 0 ; Copyright string
Reloc+0: EQUD Start ; Load address if ROMtype bit 5 is set
Reloc+4: EQUD Entry-Start ; Offset to entry if ROMtype bit 5 set
...
ALIGN ; Align to 16-bit words
Entry: ; Code start
Z80 - ROM type 8
Start+0: JR Entry:EQUB 0 ; If position-independent code
or JP Entry ; If not position-independent code
Start+3: EQUB &4C:EQUW Service ; 6502 jump to ROM service handler
or EQUB &60:EQUW 0 ; 6502 RTS if no ROM service handler
Start+6: EQUB flags+&08 ; ROM type byte
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Binary version number and title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string
Copyright: EQUB &00:EQUS "(C)J.G.Harston":EQUB 0 ; Copyright string
Reloc+0: EQUD Start ; Load address if ROMtype bit 5 is set
...
Entry: ; Code start
32000 - ROM type 9
Even if the ROM type byte bit 5 is clear the entries at Reloc+0 and Reloc+4 must be present.
Start+0: EQUB &60:EQUW 0 ; 6502 RTS
or EQUB &4C:EQUW Language65 ; 6502 jump to 6502 language stub
Start+3: EQUB &4C:EQUW Service ; 6502 jump to ROM service handler
or EQUB &60:EQUW 0 ; 6502 RTS if no ROM service handler
Start+6: EQUB flags+&09 ; ROM type byte
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Binary version number and title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string
Copyright: EQUB &00:EQUS "(C)J.G.Harston":EQUB 0 ; Copyright string
Reloc+0: EQUD Start ; Load address, even if ROMtype bit 5 is not set
Reloc+4: EQUD Entry-Start ; Offset to entry, even if ROMtype bit 5 is not set
...
Entry:
80x86 - ROM type 11
Start+0: BR Entry:EQUB 0 ; Code is entered here
or JMP Entry ;
Start+3: EQUB &4C:EQUW Service ; 6502 jump to ROM service handler
or EQUB &60:EQUW 0 ; 6502 RTS if no ROM service handler
Start+6: EQUB flags+&0B ; ROM type byte
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Binary version number and title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string
Copyright: EQUB &00:EQUS "(C)J.G.Harston":EQUB 0 ; Copyright string
Reloc+0: EQUD Start ; Load address if ROMtype bit 5 is set
...
Entry:
ARM - ROM type 13
See also notes on ARM headers.
If ROM type byte is &4D or &8D:
Start+0: EQUD Entry ; RomFS entry address
Start+4: EQUW 0
If other ROM type byte values:
Start+0: EQUW (Entry-Start-8)/4:EQUB 0:EQUB &EA ; ARM branch instruction, overlaps Start+3
Start+4: EQUB &D0:EQUB Service-Start-6 ; 6502 BNE to ROM service handler
or EQUB &60:EQUB 0 ; 6502 RTS if no ROM service handler
or:
Start+0: EQUB &4C:EQUW Entry ; &4C, followed by Entry address
Start+3: EQUB &4C:EQUW Service ; 6502 JMP to ROM service handler
or EQUB &60:EQUW 0 ; 6502 RTS if no ROM service handler
Start+6: EQUB flags+&0D ; ROM type byte
Start+7: EQUB Copyright-Start ; Offset to copyright string
Start+8: EQUB Ver:EQUS "Title" ; Binary version number and title string
EQUB &00:EQUS "0.00 (01 Jan 2001)" ; Version string
Copyright: EQUB &00:EQUS "(C)J.G.Harston":EQUB 0 ; Copyright string
Reloc+0: EQUD Start ; Load address, even if ROMtype bit 5 is not set
Reloc+4: EQUD End-Entry ; Size of code, even if ROMtype bit 5 is not set
...
ALIGN ; Align to 32-bit words
Entry:
...
End:
Extracting load/exec address
File load and execution addresses can be extracted from the code header with the following code. The execution address is the same as the load address as the client code calculates the entry point as an offset from the execution address, which is the first byte of the header.
BASIC code
REM Check for file header, using BASIC V or equivalent
in%=OPENIN(A$):IF in% THEN
FOR A%=0 TO 255:IF EOF#in%:buffer%?A%=0 ELSE buffer%?A%=BGET#in%
NEXT A%:CLOSE#in%:in%=0 :REM Read header
IF buffer%!(buffer%?7)=&29432800 THEN
A%=buffer%?6 :REM Code type
load%=&FFFF8000 :REM Sideways ROM
IF A% AND &40:load%=&8000 :REM Language ROM
IF A% AND &20 THEN
A%=buffer%?7:REPEAT A%=A%+1:UNTIL buffer%?A%=0 OR A%>247
IF A%<248:load%=buffer%!(A%+1) :REM Relocation address
ENDIF
exec%=load%
ENDIF
ENDIF
C code
// Check for file header
if(handle=fopen(pathname, "r")) {
memset(buffer, 0, 256);
fread(buffer, 1, 256, handle);
fclose(handle);
off=buffer[7];
if (buffer[off+0]==0 && buffer[off+1]=='(' && buffer[off+2]=='C' && buffer[off+3]==')') {
type=buffer[6];
load=0xFFFF8000; // Sideways ROM
if (type & 0x40) load=0x8000; // Language ROM
if (type & 0x20) { // Language relocation address
while (buffer[++off] && off<248); // Step past copyright string
if (++off<249) {
load=(buffer[off+0]&0xFF) | ((buffer[off+1]&0xFF)<<8) |
((buffer[off+2]&0xFF)<<16) | ((buffer[off+3]&0xFF)<<24);
}
}
exec=load;
}
}
Clients calculate the entry point with the following pseudo-code.
entry=start
if start[7] does not point to &00,"(C)", then enter code // Raw code
romtype=start[6]
if rombyte bit 6 is clear, then error "This is not code" // No code
if (rombyte AND 15)<>mycpu, then error "This is not MyCPU code" // Wrong CPU
switch (rombyte AND 15) {
when 7,9: // PDP11, 32000
point to the relocation address after the zero
byte at the end of the copyright string
entry=start+reload[4..7] // Offset to entry point
when 13: // ARM
if start[3]=&EA, then entry=start // ARM branch instruction
else entry=start[1..2] // Embedded address
}
enter code
ARM header notes
The ARM ROM header is complicated by having been implemented differently on different platforms, the Acorn ARM Evaluation System, the Arthur/RISC OS RomFS, and the Sprow ARM CoProcessor. (And there is also the RISC OS module format which most ARM CoPro clients can't *RUN.)
- There is always a relocation address, regardless of the setting of ROMtype bit 5.
- The data at Start+0 may be an ARM branch instruction, a 32-bit entry address or a &4C byte followed by a 16-bit entry address.
- The address at Reloc+0 is the load address of the data after the header in RomFS and is the load address of Start+0 on other systems.
ARM Evaluation System
The ARM Evaluation System simply jumps to Start+0, so the first word must be an unconditional branch to the main code. All ARM instructions take four bytes, so this overlaps into the ROM Service entry. However, an ARM branch instruction is &EAxxxxxx and &EA is a 6502 NOP instruction, so a null service entry point can be made with:
Start+0 xx B Entry ; Jump to ARM code
xx
xx
Start+3 EA ; 6502 NOP
60 EQUB &60 ; 6502 RTS
00 EQUB &00
As the ROM service handler is always entered with NE set from testing the ROM type byte a two-byte BNE instruction can be used to jump to an actual service handler:
Start+0 xx B Entry ; Jump to ARM code
xx
xx
Start+3 EA ; 6502 NOP
D0 EQUB &D0 ; 6502 BNE
xx EQUB Service-Start-6
Sprow ARM CoPro
The Sprow ARM CoPro puts the ARM entry point in the 16-bit address field of a 6502 JMP instructon, leaving space for a ROM service handler JMP at Start+3:
Start+0 4C EQUB &4C ; 6502 JMP
xx EQUW Entry
xx
Start+3 4C EQUB &4C
xx EQUW Service
xx
ARM RomFS
RomFS simply stores a 32-bit entry address at Start+0, overlapping the ROM service handler at Start+3, so the ROM type byte must have bit 7 clear. The relocation address at reloc[0...3] and the entry address at start[0..3] are actually used as load/exec addresses for the data that starts at reloc+8.
Identifying ARM header
It is not possible to create a single file that will be recognised correctly by all ARM platforms, but it is possible to examine the header and decide which ARM platform is is intended for, and consequently, what load and entry addresses it has.
Start+ 00 01 02 03 04 05 06 .. .. .. .. .. .. 0D Raw code .. .. .. .. .. .. 2D Raw code ee ee ee ee .. .. 4D RomFS file dd dd dd EA .. .. 6D ARM Evaluation System .. ee ee <>EA .. .. 6D Sprow ARM CoPro ee ee ee ee .. .. 8D RomFS directory .. .. .. .. .. .. AD Raw code dd dd dd EA .. .. CD ARM Evaluation System .. ee ee <>EA .. .. CD Sprow ARM CoPro dd dd dd EA .. .. ED ARM Evaluation System .. ee ee <>EA .. .. ED Sprow ARM CoPro
