Disassembly of an HC12 Program It is sometimes useful to be able to convert HC12 op codes into mnemonics. For example, consider the hex code:

Transcription

1 Disassembly of an HC12 Program It is sometimes useful to be able to convert HC12 op codes into mnemonics. For example, consider the hex code: ADDR DATA C6 05 FE 00 E B7 E EE 3F To determine the instructions, use Tables A.2 through A.7 of the S12CPUV2 Reference Manual. If the first byte of the instruction is anything other than $18, use Sheet 1 of Table A.2 (Page 395). From this table, determine the number of bytes of the instruction and the addressing mode. For example, $C6 is a two-byte instruction, the mnemonic is LDAB, and it uses the IMM addressing mode. Thus, the two bytes C6 05 is the op code for the instruction LDAB #$05. The op code FE is LDX using the EXT addressing mode, and has 3 bytes total, with the last two bytes being the extended address. Thus, FE 00 is the instruction LDX $00. Indexed addressing mode is fairly complicated to disassemble. You need to use Table A.3 to determine the operand. For example, the op code $E6 indicates LDAB indexed, and may use two to four bytes (one to three bytes in addition to the op code). The postbyte 01 indicates that the operand is 0,1, which is 5-bit constant offest, which takes only one additional byte. All 5-bit constant offset, pre and post increment and decrement, and register offset instructions use one additional byte. All 9-bit constant offset instructions use two additional bytes, with the second byte holding 8 bits of the 9 bit offset. (The 9th bit is a direction bit, which is held in the first postbyte.) All 16-bit constant offset instructions use three postbytes, withe the 2nd and 3rd holding the 16-bit unsigned offset. If the first byte is $18, use Sheet 2 of Table A.2 (Page 396). For example, is a two byte instruction, the mnemonic is ABA, and it uses the INH addressing mode, so there is no operand. Thus, the two bytes is the op code for the instruction ABA. Transfer (TFR) and exchange (EXG) instructions all have the op code $B7 with one post-byte. Use Table A.5 to determine whether it is TFR or an EXG, and to determine which registers are being used. If the most significant bit of the postbyte is 0, the instruction is a transfer instruction. B7 E5 is the code for the instruction EXG Y,X. Loop instructions (Decrement and Branch, Increment and Branch, and Test and Branch) all have the op code $04. To determine which instruction the op code $04 implies, and whether the branch is positive (forward) or negative (backward), use Table A.6. For example, in the sequence EE, the 04 indicates a loop instruction. The 35 indicates it is a X instruction (decrement register X and branch if result is not equal to zero), and the direction is backward (negative). The EE indicates a branch of -18 bytes (take the 2 s complement of EE. 1

2 Use up all the bytes for one instruction, then go on to the next instruction. ADDR DATA C6 05 FE 00 E B7 E EE 3F C6 05 => LDAB #$05 two-byte LDAB, IMM addressing mode 2002 FE 00 => LDX $00 three-byte LDX, EXT addressing mode 2005 E6 01 => LDAB 1,X two to four-byte LDAB, IDX addressing mode. Operand 01 => 1,X, a ant offset which uses only one postbyte => ABA two-byte ABA, INH addressing mode 2009 B7 E5 => EXG Y,X two-byte exchange/transfer instruction MSB of post-byte = 1 => exchange From Table A.5, E5 => (Y <=> X) 200b EE => X,(-18) three-byte loop instruction Postbyte 35 indicates X, negative 2 s complement of 0xEE is -18 decimal 200e 3F => SWI one-byte SWI, INH addressing mode 2

3 Freescale Semiconductor 395 S12CPUV2 Reference Manual, Rev BGND 01 5 MEM 02 1 INY 03 1 DEY 04 3 loop * RL JMP 06 3 JMP 07 4 BSR 08 1 INX 09 1 DEX 0A 7 RTC 0B 8 RTI 0C 4-6 BSET 0D 4-6 BCLR 0E 4-6 BRSET ID 4-6 0F 4-6 BRCLR ID ANDCC EDIV 12 1 MUL 13 3 EMUL 14 1 ORCC JSR 16 4 JSR 17 4 JSR 18 - Page LEAY 1A 2 LEAX 1B 2 LEAS 1C 4 BSET EX 4 1D 4 BCLR EX 4 1E 5 BRSET EX 5 1F 5 BRCLR EX BRA 21 1 BRN 22 3/1 BHI 23 3/1 BLS 24 3/1 BCC 25 3/1 BCS 26 3/1 BNE 27 3/1 BEQ 28 3/1 BVC 29 3/1 BVS 2A 3/1 BPL 2B 3/1 BMI 2C 3/1 BGE 2D 3/1 BLT 2E 3/1 BGT 2F 3/1 BLE 30 3 PULX 31 3 PULY 32 3 PULA 33 3 PULB 34 2 PSHX 35 2 PSHY 36 2 PSHA 37 2 PSHB 38 3 PULC 39 2 PSHC 3A 3 PULD 3B 2 PSHD 3C +5 wavr SP 1 3D 5 RTS 3E 7 WAI 3F 9 SWI 40 1 NEGA 41 1 COMA 42 1 INCA 43 1 DECA 44 1 LSRA 45 1 ROLA 46 1 RORA 47 1 ASRA 48 1 ASLA 49 1 LSRD 4A 7 CALL EX 4 4B 7- CALL ID 2-5 4C 4 BSET DI 3 4D 4 BCLR DI 3 4E 4 BRSET DI 4 4F 4 BRCLR DI 4 Key to Table A-2 Opcode Mnemonic Address Mode Table A-2. CPU12 Opcode Map (Sheet 1 of 2) 50 1 NEGB 51 1 COMB 52 1 INCB 53 1 DECB 54 1 LSRB 55 1 ROLB 56 1 RORB 57 1 ASRB 58 1 ASLB 59 1 ASLD 5A 2 STAA 5B 2 STAB 5C 2 STD 5D 2 STY 5E 2 STX 5F 2 STS NEG COM INC DEC LSR ROL ROR ASR ASL CLR 6A 2-4 STAA 6B 2-4 STAB 6C 2-4 STD 6D 2-4 STY 6E 2-4 STX 6F 2-4 STS 00 5 BGND IH I 70 4 NEG 71 4 COM 72 4 INC 73 4 DEC 74 4 LSR 75 4 ROL 76 4 ROR 77 4 ASR 78 4 ASL 79 3 CLR 7A 3 STAA 7B 3 STAB 7C 3 STD 7D 3 STY 7E 3 STX 7F 3 STS 80 1 SUBA 81 1 CMPA 82 1 SBCA 83 2 SUBD 84 1 ANDA 85 1 BITA 86 1 LDAA 87 1 CLRA 88 1 EORA 89 1 ADCA 8A 1 ORAA 8B 1 ADDA 8C 2 CPD 8D 2 CPY 8E 2 CPX 8F 2 CPS 90 3 SUBA 91 3 CMPA 92 3 SBCA 93 3 SUBD 94 3 ANDA 95 3 BITA 96 3 LDAA 97 1 TSTA 98 3 EORA 99 3 ADCA 9A 3 ORAA 9B 3 ADDA 9C 3 CPD 9D 3 CPY 9E 3 CPX 9F 3 CPS A0 3-6 SUBA A1 3-6 CMPA A2 3-6 SBCA A3 3-6 SUBD A4 3-6 ANDA A5 3-6 BITA A6 3-6 LDAA A7 1 NOP A8 3-6 EORA A9 3-6 ADCA AA 3-6 ORAA AB 3-6 ADDA AC 3-6 CPD AD 3-6 CPY AE 3-6 CPX AF 3-6 CPS B0 3 SUBA B1 3 CMPA B2 3 SBCA B3 3 SUBD B4 3 ANDA B5 3 BITA B6 3 LDAA B7 1 TFR/EXG B8 3 EORA B9 3 ADCA BA 3 ORAA BB 3 ADDA BC 3 CPD BD 3 CPY BE 3 CPX BF 3 CPS C0 1 SUBB C1 1 CMPB C2 1 SBCB C3 2 ADDD C4 1 ANDB C5 1 BITB C6 1 LDAB C7 1 CLRB C8 1 EORB C9 1 ADCB CA 1 ORAB CB 1 ADDB CC 2 LDD CD 2 LDY CE 2 LDX CF 2 LDS Number of HCS12 cycles ( indicates HC12 different) Number of bytes D0 3 SUBB D1 3 CMPB D2 3 SBCB D3 3 ADDD D4 3 ANDB D5 3 BITB D6 3 LDAB D7 1 TSTB D8 3 EORB D9 3 ADCB DA 3 ORAB DB 3 ADDB DC 3 LDD DD 3 LDY DE 3 LDX DF 3 LDS E0 3-6 SUBB E1 3-6 CMPB E2 3-6 SBCB E3 3-6 ADDD E4 3-6 ANDB E5 3-6 BITB E6 3-6 LDAB E7 3-6 TST E8 3-6 EORB E9 3-6 ADCB EA 3-6 ORAB EB 3-6 ADDB EC 3-6 LDD ED 3-6 LDY EE 3-6 LDX EF 3-6 LDS F0 3 SUBB F1 3 CMPB F2 3 SBCB F3 3 ADDD F4 3 ANDB F5 3 BITB F6 3 LDAB F7 3 TST F8 3 EORB F9 3 ADCB FA 3 ORAB FB 3 ADDB FC 3 LDD FD 3 LDY FE 3 LDX FF 3 LDS 3

4 396 Freescale Semiconductor S12CPUV2 Reference Manual, Rev MOVW IM-ID MOVW EX-ID MOVW ID-ID MOVW IM-EX MOVW EX-EX MOVW ID-EX ABA 07 3 DAA 08 4 MOVB IM-ID MOVB EX-ID 5 0A 5 MOVB ID-ID 4 0B 4 MOVB IM-EX 5 0C 6 MOVB EX-EX 6 0D 5 MOVB ID-EX 5 0E 2 TAB 0F 2 TBA 12 IDIV FDIV EMACS SP EMULS EDIVS IDIVS 16 2 SBA 17 2 CBA MAXA MINA 1A 4-7 EMAXD 1B 4-7 EMIND 1C 4-7 MAXM 1D D4-7 MINM 1E 4-7 EMAXM 1F 4-7 EMINM 20 4 LBRA 21 3 LBRN 22 4/3 LBHI 23 4/3 LBLS 24 4/3 LBCC 25 4/3 LBCS 26 4/3 LBNE 27 4/3 LBEQ 28 4/3 LBVC 29 4/3 LBVS 2A 4/3 LBPL 2B 4/3 LBMI 2C 4/3 LBGE 2D 4/3 LBLT 2E 4/3 LBGT 2F 4/3 LBLE A 3n REV SP 2 3B 5n/3n REVW SP A 4B A 5B A 6B A 7B A 8B A 9B A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 BA BB C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB D0 D1 D2 D3 D4 D5 D6 D7 D8 D9 DA DB E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 EA EB F0 F1 F2 F3 F4 F5 F6 F7 F8 F9 FA FB 3C 7B 4C 5C 6C 7C 8C 9C AC BC CC DC EC FC WAV SP 2 3D 6 4D 5D 6D 7D 8D 9D AD BD CD DD ED FD TBL ID 3 3E 8 STOP 3F ETBL ID 3 4E 4F Table A-2. CPU12 Opcode Map (Sheet 2 of 2) 5E 5F 6E 6F 7E 7F 8E 8F 9E 9F AE AF BE BF CE CF DE DF EE EF FE FF * The opcode $04 (on sheet 1 of 2) corresponds to one of the loop primitive instructions,,,,, or. Refer to instruction summary for more information. Refer to instruction summary for different HC12 cycle count. Page 2: When the CPU encounters a page 2 opcode ($18 on page 1 of the opcode map), it treats the next byte of object code as a page 2 instruction opcode. 4

5 Freescale Semiconductor 397 S12CPUV2 Reference Manual, Rev ,X 01 1,X 02 2,X 03 3,X 04 4,X 05 5,X 06 6,X 07 7,X 08 8,X 09 9,X 0A,X 0B 11,X 0C 12,X 0D 13,X 0E 14,X 0F 15,X 16,X 11 15,X 12 14,X 13 13,X 14 12,X 15 11,X 16,X 17 9,X 18 8,X 19 7,X 1A 6,X 1B 5,X 1C 4,X 1D 3,X 1E 2,X 1F 1,X 20 1,+X 21 2,+X 22 3,+X 23 4,+X 24 5,+X 25 6,+X 26 7,+X 27 8,+X 28 8, X 29 7, X 2A 6, X 2B 5, X 2C 4, X 2D 3, X 2E 2, X 2F 1, X 30 1,X+ 31 2,X+ 32 3,X+ 33 4,X+ 34 5,X+ 35 6,X+ 36 7,X+ 37 8,X+ 38 8,X 39 7,X 3A 6,X 3B 5,X 3C 4,X 3D 3,X 3E 2,X 3F 1,X Table A-3. Indexed Addressing Mode Postbyte Encoding (xb) 40 0,Y 41 1,Y 42 2,Y 43 3,Y 44 4,Y 45 5,Y 46 6,Y 47 7,Y 48 8,Y 49 9,Y 4A,Y 4B 11,Y 4C 12,Y 4D 13,Y 4E 14,Y 4F 15,Y 50 16,Y 51 15,Y 52 14,Y 53 13,Y 54 12,Y 55 11,Y 56,Y 57 9,Y 58 8,Y 59 7,Y 5A 6,Y 5B 5,Y 5C 4,Y 5D 3,Y 5E 2,Y 5F 1,Y 60 1,+Y 61 2,+Y 62 3,+Y 63 4,+Y 64 5,+Y 65 6,+Y 66 7,+Y 67 8,+Y 68 8, Y 69 7, Y 6A 6, Y 6B 5, Y 6C 4, Y 6D 3, Y 6E 2, Y 6F 1, Y Key to Table A-3 postbyte (hex) type offset used 70 1,Y+ 71 2,Y+ 72 3,Y+ 73 4,Y+ 74 5,Y+ 75 6,Y+ 76 7,Y+ 77 8,Y+ 78 8,Y 79 7,Y 7A 6,Y 7B 5,Y 7C 4,Y 7D 3,Y 7E 2,Y 7F 1,Y 80 0,SP 81 1,SP 82 2,SP 83 3,SP 84 4,SP 85 5,SP 86 6,SP 87 7,SP 88 8,SP 89 9,SP 8A,SP 8B 11,SP 8C 12,SP 8D 13,SP 8E 14,SP 8F 15,SP B0 #,REG type 90 16,SP 91 15,SP 92 14,SP 93 13,SP 94 12,SP 95 11,SP 96,SP 97 9,SP 98 8,SP 99 7,SP 9A 6,SP 9B 5,SP 9C 4,SP 9D 3,SP 9E 2,SP 9F 1,SP A0 1,+SP A1 2,+SP A2 3,+SP A3 4,+SP A4 5,+SP A5 6,+SP A6 7,+SP A7 8,+SP A8 8, SP A9 7, SP AA 6, SP AB 5, SP AC 4, SP AD 3, SP AE 2, SP AF 1, SP source code syntax B0 1,SP+ B1 2,SP+ B2 3,SP+ B3 4,SP+ B4 5,SP+ B5 6,SP+ B6 7,SP+ B7 8,SP+ B8 8,SP B9 7,SP BA 6,SP BB 5,SP BC 4,SP BD 3,SP BE 2,SP BF 1,SP C0 0,PC C1 1,PC C2 2,PC C3 3,PC C4 4,PC C5 5,PC C6 6,PC C7 7,PC C8 8,PC C9 9,PC CA,PC CB 11,PC CC 12,PC CD 13,PC CE 14,PC CF 15,PC D0 16,PC D1 15,PC D2 14,PC D3 13,PC D4 12,PC D5 11,PC D6,PC D7 9,PC D8 8,PC D9 7,PC DA 6,PC DB 5,PC DC 4,PC DD 3,PC DE 2,PC DF 1,PC E0 n,x 9b const E1 n,x 9b const E2 n,x 16b const E3 [n,x] 16b indr E4 A,X A offset E5 B,X B offset E6 D,X D offset E7 [D,X] D indirect E8 n,y 9b const E9 n,y 9b const EA n,y 16b const EB [n,y] 16b indr EC A,Y A offset ED B,Y B offset EE D,Y D offset EF [D,Y] D indirect F0 n,sp 9b const F1 n,sp 9b const F2 n,sp 16b const F3 [n,sp] 16b indr F4 A,SP A offset F5 B,SP B offset F6 D,SP D offset F7 [D,SP] D indirect F8 n,pc 9b const F9 n,pc 9b const FA n,pc 16b const FB [n,pc] 16b indr FC A,PC A offset FD B,PC B offset FE D,PC D offset FF [D,PC] D indirect 5

6 Freescale Semiconductor 399 S12CPUV2 Reference Manual, Rev. 4.0 Table A-5. Transfer and Exchange Postbyte Encoding TRANSFERS LS MS A A B A CCR A TMP3 L A B A X L A Y L A SP L A 1 A B B B CCR B TMP3 L B B B X L B Y L B SP L B 2 A CCR B CCR CCR CCR TMP3 L CCR B CCR X L CCR Y L CCR SP L CCR 3 sex:a TMP2 sex:b TMP2 sex:ccr TMP2 TMP3 TMP2 D TMP2 X TMP2 Y TMP2 SP TMP sex:a D SEX A,D sex:a X SEX A,X sex:a Y SEX A,Y sex:a SP SEX A,SP sex:b D SEX B,D sex:b X SEX B,X sex:b Y SEX B,Y sex:b SP SEX B,SP sex:ccr D SEX CCR,D sex:ccr X SEX CCR,X sex:ccr Y SEX CCR,Y sex:ccr SP SEX CCR,SP EXCHANGES TMP3 D D D X D Y D SP D TMP3 X D X X X Y X SP X TMP3 Y D Y X Y Y Y SP Y TMP3 SP D SP X SP Y SP SP SP LS MS 8 9 A B C D E F 0 A A B A CCR A 1 A B B B CCR B 2 A CCR B CCR CCR CCR 3 $00:A TMP2 TMP2 L A $00:B TMP2 TMP2 L B 4 $00:A D $00:B D $00:A X X L A $00:A Y Y L A $00:A SP SP L A TMP2 and TMP3 registers are for factory use only. $00:B X X L B $00:B Y Y L B $00:B SP SP L B $00:CCR TMP2 TMP2 L CCR $00:CCR D B CCR $00:CCR X X L CCR $00:CCR Y Y L CCR $00:CCR SP SP L CCR TMP3 L A $00:A TMP3 TMP3 L B $FF:B TMP3 TMP3 L CCR $FF:CCR TMP3 B A A B B B $FF A B CCR $FF:CCR D X L A $00:A X X L B $FF:B X X L CCR $FF:CCR X Y L A $00:A Y Y L B $FF:B Y Y L CCR $FF:CCR Y SP L A $00:A SP SP L B $FF:B SP SP L CCR $FF:CCR SP TMP3 TMP2 D TMP2 X TMP2 Y TMP2 SP TMP2 TMP3 D D D X D Y D SP D TMP3 X D X X X Y X SP X TMP3 Y D Y X Y Y Y SP Y TMP3 SP D SP X SP Y SP SP SP 6

7 Table A-6. Loop Primitive Postbyte Encoding (lb) 00 A 01 B 02 A 11 B A 21 B A 31 B A 41 B A 51 B A 61 B A 71 B A 81 B A 91 B 92 A0 A A1 B A2 B0 A B1 B B A3 B3 04 D 05 X 06 Y 07 SP 14 D 15 X 16 Y 17 SP 24 D 25 X 26 Y 27 SP 34 D 35 X 36 Y 37 SP 44 D 45 X 46 Y 47 SP 54 D 55 X 56 Y 57 SP 64 D 65 X 66 Y 67 SP 74 D 75 X 76 Y 77 SP 84 D 85 X 86 Y 87 SP 94 D 95 X 96 Y 97 SP A4 D A5 X A6 Y A7 SP B4 D B5 X B6 Y B7 SP Key to Table A-6 postbyte (hex) (bit 3 is don t care) branch condition B0 A _BEQ counter used sign of 9-bit relative branch offset (lower eight bits are an extension byte following postbyte) Table A-7. Branch/Complementary Branch Branch Complementary Branch Test Mnemonic Opcode Boolean Test Mnemonic Opcode Comment r>m BGT 2E Z + (N V) = 0 r m BLE 2F Signed r m BGE 2C N V = 0 r<m BLT 2D Signed r=m BEQ 27 Z = 1 r m BNE 26 Signed r m BLE 2F Z + (N V) = 1 r>m BGT 2E Signed r<m BLT 2D N V = 1 r m BGE 2C Signed r>m BHI 22 C + Z = 0 r m BLS 23 Unsigned r m BHS/BCC 24 C = 0 r<m BLO/BCS 25 Unsigned r=m BEQ 27 Z = 1 r m BNE 26 Unsigned r m BLS 23 C + Z = 1 r>m BHI 22 Unsigned r<m BLO/BCS 25 C = 1 r m BHS/BCC 24 Unsigned Carry BCS 25 C = 1 No Carry BCC 24 Simple Negative BMI 2B N = 1 Plus BPL 2A Simple Overflow BVS 29 V = 1 No Overflow BVC 28 Simple r=0 BEQ 27 Z = 1 r 0 BNE 26 Simple Always BRA 20 Never BRN 21 Unconditional For 16-bit offset long branches precede opcode with a $18 page prebyte. S12CPUV2 Reference Manual, Rev Freescale Semiconductor 7

8 Binary, Hex and Decimal Numbers (4-bit representation) Binary Hex A B C D E F Decimal

9 What does a number represent? Binary numbers are a code, and represent what the programmer intends for the code. 0x72 Some possible codes: r (ASCII) INC (HC12 instruction) 2.26V (Input from A/D converter) 114 (Unsigned 8 bit number) +114 (Signed 8 bit number) Set temperature in room to 69 F Set cruise control speed to 120 mph 9

10 Binary to Unsigned Decimal: Convert Binary to Unsigned Decimal x x x x x x x 2 1 x x x x x x x Hex to Unsigned Decimal Convert Hex to Unsigned Decimal 82D x x x x 16 8 x x x x

11 Unsigned Decimal to Hex Convert Unsigned Decimal to Hex Division Q R Decimal Hex 721/ / D 2/ = 2D

12 Signed Number Representation in 2 s Complement Form: If most significant bit is 0 (most significant hex digit 0 7), number is positive. Get decimal equivalent by converting number to decimal, and using + sign. Example for 8 bit number: 1 0 3A > + ( 3 x 16 + x 16 ) 16 + ( 3 x 16 + x 1 ) + 58 If most significant bit is 1 (most significant hex digit 8 F), number is negative. Get decimal equivalent by taking 2 s complement of number, converting to decimal, and using sign. Example for 8 bit number: A3 > ( 5D ) ( 5 x x 16 ) ( 5 x x 1 ) 93 12

13 One s Complement Table Makes It Simple To Find 2 s Complements One s Complement Table F E D C B A To take two s complement, add one to one s complement. Take two s complement of D0C3 : 2F3C + 1 = 2F3D 13

14 Addition and Subtraction of Hexadecimal Numbers. Setting the C (Carry), V (Overflow), N (Negative) and Z (Zero) bits How the C, V, N and Z bits of the CCR are changed Condition Code Register Bits N, Z, V, C N bit is set if result of operation in negative (MSB = 1) Z bit is set if result of operation is zero (All bits = 0) V bit is set if operation produced an overflow C bit is set if operation produced a carry (borrow on subtraction) Note: Not all instructions change these bits of the CCR 14

15 ADDITION: Addition of Hexadecimal Numbers C bit set when result does not fit in word V bit set when P + P = N N + N = P N bit set when MSB of result is 1 Z bit set when result is 0 7A +52 2A +52 AC +8A AC +72 CC 7C 36 1E C: 0 C: 0 C: 1 C: 1 V: 1 V: 0 V: 1 V: 0 N: 1 N: 0 N: 0 N: 1 Z: 0 Z: 0 Z: 0 Z: 0 15

16 SUBTRACTION: Subtraction of Hexadecimal Numbers C bit set on borrow (when the magnitude of the subtrahend is greater than the minuend) V bit set when N P = P P N = N N bit set when MSB is 1 Z bit set when result is 0 7A 5C 8A 5C 5C 8A 2C 72 1E 2E D2 BA C: 0 C: 0 C: 1 C: 1 V: 0 V: 1 V: 1 V: 0 N: 0 N: 0 N: 1 N: 1 Z: 0 Z: 0 Z: 0 Z: 0 16