STM32F0 /F1 /F4 Opcode List? - Page 1
Forum section: electronics / general

author: bernie79
author_rank: Contributor
timestamp: December 29, 2018, 06:30:18 pm
content: Hello,The threathttps://www.eevblog.com/forum/microcontrollers/stm32-without-stm-libraries/reminds me of a open question.Does someone know a source of a complete opcode list? The STM32 is a Cortex M3, so Thump and Thump-2 ISA is valid. But the nearest, I can come by datasheets of ST is the description of all assembler mnemonics. But in this comprehensive list, the only inforfation is missing is the opcode.At arm.com you can get an thump2-opcode sheet, in which are the ISA opcode bitmask is explained.[ 1 1 0 1 cond imm8] for cond see ..... Seeking the exact opcode drives me nuts.e:G.if you want to write a count loop,, you have usually a count register (lets say R03) that gets counted down to zero.in the end of the loop, you check, if R03 is zero and branch to the breakpoint some instruction in the program counter awayin c like this:loopstart:.....r03--;if (r03 ==0) { goto break; }goto loopstart;break:// do after the loopin (opcode and) assembler it looks likeloopstart:...0x3b 0x01 SUB r03, #10xb1 0x0b CBZ r03,break0xd1 0xfd JMP loopstartbreak:Okay the opcode is added by me. This is, what a disassembler should list.but I cannot find any list of opcode to mnemonic like other CPU datasheets: (intel, zilog, atmel, pic, mips,...).Is this such a secret? How does the developer of assembler or dissassembler solve this?GreetingsBernie

author: Jeroen3
author_rank: Super Contributor
timestamp: December 29, 2018, 07:39:52 pm
content: Why would you care about that? ARM is much more complicated than AVR or 8051.Anyway, this data seems to be in theARM®v7-M Architecture Reference Manualwhich is only available to registered arm customers it seems.Also, thumb isn’t literal mnemonic to opcode, it has funny business with alignment if opcodes don’t have arguments.It looks like you can request this document from ARM if you create an account.

author: westfw
author_rank: Super Contributor
timestamp: December 29, 2018, 07:52:18 pm
content: If you want a datasheet that describes the instructions for CM3, you can download the Atmel SAM3X datasheet. In some ways, it's nicer than the ARM Achitecture Reference Manual (ie, the relevant section describing the CPU is only about 150 pages, instead of over 800.The instruction set summary starts on page 81:http://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-11057-32-bit-Cortex-M3-Microcontroller-SAM3X-SAM3A_Datasheet.pdfARM apparently discourages this, instead preferring chip vendors to point to their documentation for the CPU core. The Atmel CM0+ chips don't have this section :-(I don't know offhand of a CM4 chip with an extended manual. (Maybe TI?)Note that a particular instruction mnemonic can have several possible "encodings" depending on (say) the size of constant values in the instruction. For the encodings, you need the ARM manual.

author: westfw
author_rank: Super Contributor
timestamp: December 29, 2018, 08:03:13 pm
content: Oops. I may have misunderstood the question.The actual numeric encoding of opcodes is only in the ARM ARM, AFAIK. "encoding" is the key term.See section A.5.xCode:opcode Instruction or instruction class00xxxx Shift (immediate), add, subtract, move, and compare on page A5-130010000 Data processing on page A5-131010001 Special data instructions and branch and exchange on page A5-13201001x Load from Literal Pool, see LDR (literal) on page A7-2480101xx Load/store single data item on page A5-133011xxx100xxx10100x Generate PC-relative address, see ADR on page A7-19810101x Generate SP-relative address, see ADD (SP plus immediate) on page A7-194 1011xx Miscellaneous 16-bit instructions on page A5-13411000x Store multiple registers, see STM, STMIA, STMEA on page A7-38311001x Load multiple registers, see LDM, LDMIA, LDMFD on page A7-2421101xx Conditional branch, and Supervisor Call on page A5-13611100x Unconditional Branch, see B on page A7-205

author: ataradov
author_rank: Super Contributor
timestamp: December 29, 2018, 09:05:14 pm
content: The key thing to understand with ARM devices is that information is spread over multiple documents, since devices are assembled from bits and pieces provided by different suppliers.In theory device datasheet should be very short and just list basic blocks the device is assembled from. This is the case for ST products. The datasheet should also mention all the documents applicable to the product. This does not happen very often or at all.Assembling everything into a single document does not make sense. For a typical Corte-M4 device there will easily be 50000+ pages of relevant documentation. Most of it is available for ARM.

author: bernie79
author_rank: Contributor
timestamp: December 29, 2018, 11:59:54 pm
content: Quote from: westfw on December 29, 2018, 08:03:13 pmIndeed. this is the nearest you got with the ARM documentation. Several bits of the opcode (here 6bit) out of 16 or 32 bit. And in the docs on this 50k pages are the several conditions, if an opcode combination is valid or not. If one person reads 8 hours a day, put this together in a list and make no mistakes, this will last weeks. I hope, there is such a list already done. The whole information is coded in only one single piece: the instruction decoder of the ARM-CPU. Maybe an core doesn't got a FPU, but thats simply masks out a part of this table as illegal instruction.Or in another words: the is a instruction decoder. So it must exist a single table with all opcodes (constants excluded).Because of the 32bit ISA this list is not suiteable for an educational doc, But for looking up reasons, there should be a possibility. Yes I know there are online disassembler, but thats 'trial and error'.And yes, such a list makes sense: If you ultimately want to know if a certain mnemonic is valid (e.g. ADD SP,SP,#192), you can look in this table an see #192 is too big (only 7 bits allowed).It dawned to me why there are so few alternatives to IDA Pro.

author: ataradov
author_rank: Super Contributor
timestamp: December 30, 2018, 12:17:55 am
content: I don't understand your problem. The documents you are looking for are DDI0403D_arm_architecture_v7m_reference_manual.pdf and DDI0419C_arm_architecture_v6m_reference_manual.pdf. They have complete and detailed description of every instruction and its behavior.There is enough information to not only crate a disassembler, but to create the core itself from scratch.You may also want to check out documentation for the actual cores: DDI0337E_cortex_m3_r1p1_trm.pdf, DDI0439B_cortex_m4_r0p0_trm.pdf, DDI0484C_cortex_m0p_r0p1_trm.pdf, DDI0489C_cortex_m7_trm.pdf.All ARM documents contain references to other documents.And if you think that there are no alternatives to IDA because of the lack of documentation, then you are really really wrong.

author: bernie79
author_rank: Contributor
timestamp: December 30, 2018, 01:41:46 am
content: Quote from: ataradov on December 30, 2018, 12:17:55 amThat are the docs I have already quoted. To put this literally in one seacheable table or look-up-table, you have to type everything together, read up almost all linked docs and end up in a big chunk of workload. Maybe someone has done this already and have made this public. It gives another point of view to the ISA of a CPU. And I ask if someone know of a url where such a table can be downloaded. (sorry,I cannot describe the problem more simple)For the Zilog Z80 you can go to several websites (e.g.http://z80-heaven.wikidot.com/opcode-reference-chart) or take the pdf and write up such a table with a few klicks. (okay, its a 8-bit-CPU with only some two byte commands. This can easily addressed)Also an intel x86 table can found on google (e.g.http://ref.x86asm.net/geek32.html).

author: andersm
author_rank: Super Contributor
timestamp: December 30, 2018, 02:22:15 am
content: The architecture reference manual has a whole section titled "Alphabetical list of ARMV7-M Thumb instructions" where you can look up the encodings for every instruction. If you use a PDF reader that's not complete garbage (ie. not Acrobat), you can find the instruction in about three clicks, and see that there are actually four different instruction encodings that allow you to add the immediate 192 to the stack pointer (A7.7.5, ADD (SP plus immediate)).The tables you linked are useful if you want to decode instructions, but that's not what you asked about.

author: ataradov
author_rank: Super Contributor
timestamp: December 30, 2018, 02:24:34 am
content: You can probably extract those tables from existing disassemblers. There is no real need for such a table in actual development for those devices, so one does not exist.It would take a day at most to extract it from the documents if you need it, so I don't understand the complaining. Stick with AVR if opcode table is such a critical requirement.

author: bernie79
author_rank: Contributor
timestamp: December 30, 2018, 06:59:43 am
content: Quote from: ataradov on December 30, 2018, 02:24:34 amGetting them from existing diassemblers is a way. But i had hoped there is already an official document. Doesnt seem so. And you are right - the common developer for ARM based devices doesnt need such table. Most of them are even unfamilar with assembler language (no need for that). But I dont try to develop something here, and the AVR is also the totally wrong direction, as this goes about ARM.Okay this thread can be closed, as there is no answer. Nodoby seems to know a good source for a complete opcode list, but ataradows suggestion to extract from existing disassemblers comes close to the answer.Thanks all for contributing

author: westfw
author_rank: Super Contributor
timestamp: December 30, 2018, 09:28:19 am
content: It's a tree. You take the 6 bits (or less) in the table I quoted, and then follow a branch to another table that describes the additional bits. (For example "111nnx" where nn is not 00 takes you to the 32bit thumb instructions, if they're present.)It's probably because the THUMB instruction decode is a multi-step process, using relatively simple (combinatorial?) logic to generate old-style (and less variable) 32bit ARM instructions from the compressed form.It shouldn't take that long to put together the whole tree (although I agree that it would be nicer if it already existed.) Instruction sets like thumb don't have the nice clean format of an 8bit CPU or PDP-x, so you can't have a simple table...Even an AVR is messy:http://www.oocities.org/westfw/avr-instructionset.html

author: ogden
author_rank: Super Contributor
timestamp: December 30, 2018, 10:00:59 am
content: Quote from: ataradov on December 30, 2018, 02:24:34 amRight. Today there's no need for assembler or opcode knowledge. Compilers /w their intrinsics are extremely good today. On the other hand opcode "cheat sheet" tables are still made:http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001l/QRC0001_UAL.pdfMost likely for those who are building compilers

author: ataradov
author_rank: Super Contributor
timestamp: December 30, 2018, 10:28:44 am
content: Quote from: ogden on December 30, 2018, 10:00:59 amWell, this thing is actually useful. I have that printed out and handy. I still have to look at the disassembly quite a bit and occasionally write assembly inserts.But I don't care about actual opcodes at all.

author: cv007
author_rank: Frequent Contributor
timestamp: December 30, 2018, 12:55:28 pm
content: Since I had an arm compiler warmed up- you can create your own info from available tools (objdump)Code:fil="all.bin">$filopfil="dump.txt"objdump="./arm-none-eabi-objdump"n="0 1 2 3 4 5 6 7 8 9 A B C D E F"for b1h in $n; do for b1l in $n; do for b0h in $n; do for b0l in $n; doprintf "\x$b0h$b0l\x$b1h$b1l" >> $fildone; done; done; done$objdump -Dz -b binary -marm -M force-thumb $fil | grep -v "UNDEFINED" | grep -v "illegal" | sed 's: ::g' | sed 's:\t: :g' > $opfilYou will end up with 'groups' that you can see how the opcode relates the instructions, but the documentation already shows that. Probably not real useful as-is, but some more text crunching could get you close to what you want.edit- add binary for opcode-Code:#Rebol script- to insert binary of opcode after opcodeto-bin: func [enbase/base first to-block rejoin ["#{" first to-block join "#" s "}"] 2]lins: read/lines %dump.txtforall lins [ all [ find lins/1 "0: 0000" break ] ] ;skip headerstart: lins ;save locationforall lins [d2: second parse lins/1 nonereplace lins/1 d2 rejoin [ d2 " " to-bin d2 ]]write/lines %dump2.txt startand end up with-Code:...3ffc: 1ffe 0001111111111110 subs r6,r7,#73ffe: 1fff 0001111111111111 subs r7,r7,#74000: 2000 0010000000000000 movs r0,#04002: 2001 0010000000000001 movs r0,#14004: 2002 0010000000000010 movs r0,#24006: 2003 0010000000000011 movs r0,#3...QuoteThat 'C' code took you 10 seconds to write. Unless you are in the disassembler/compiler business, I would spend my time getting good at c/c++.

author: cstratton
author_rank: Regular Contributor
timestamp: December 30, 2018, 04:54:33 pm
content: Quote from: ogden on December 30, 2018, 10:00:59 amI'd disagree that there is no need. But what compilers and disassemblers do end up doing is creating a situation where by the time you do actually have to mentally contemplate opcodes, you are hopefully looking at a very small chunk of machine code to either make sense of or write.For example, you're thinking "I have 6 bytes I can change and I need to do x..." or "huh, why do those bytes decode to that"?And then you go to the docs to research that very specific problem.

author: Jeroen3
author_rank: Super Contributor
timestamp: January 09, 2019, 03:33:23 pm
content: So it appears google can find it after all:ARM®v7-M Architecture Reference ManualSee chapter A7.

author: ataradov
author_rank: Super Contributor
timestamp: January 09, 2019, 05:42:49 pm
content: Quote from: Jeroen3 on January 09, 2019, 03:33:23 pmWe have discussed this document way back. OP does not want to manually extract this information, he wants to have that in some machine-readable format. And this does not exist.

author: amyk
author_rank: Super Contributor
timestamp: January 09, 2019, 10:07:19 pm
content: You may find this useful:https://alastairreid.github.io/alastairreid.github.io/ARM-v8a-xml-release/(You did ask for "machine-readable", not "human-readable"...)Also:http://imrannazar.com/ARM-Opcode-MapThe search keywords you're looking for is "opcode map".

author: ataradov
author_rank: Super Contributor
timestamp: January 09, 2019, 10:53:23 pm
content: Quote from: amyk on January 09, 2019, 10:07:19 pmThis is extremely cool. I always assumed that those instruction behavior code snippets are not just simple text. Good to see a confirmation for this.This is basically what OP needs.