One word, or two
An AVR instruction is a 16-bit word, stored little-endian, and four instructions (LDS, STS, JMP, CALL) are followed by a
second 16-bit word holding an address. So an instruction is 2 or 4 bytes long, always at an even byte address. The opcode is spread over the word with the operands
in the bits that remain; the disassembler finds it by comparing the word with a mask and a pattern for each instruction.
The viewer therefore decodes at every even address. The first column is the plain disassembly from the start of the region; the second holds what a jump to the second word of a two-word instruction would run.
The fields
The pattern of each instruction is written most significant bit first, with 0 and 1 fixed and a letter for each operand bit. The letters:
| Letter | Operand | Range |
|---|---|---|
d, r | destination and source register; five bits, r is split (bit 9 and bits 3 to 0) | r0 to r31 |
d (4 bits) | register of the immediate group: 16 plus the field | r16 to r31 (LDI, CPI, SUBI, SBCI, ANDI, ORI) |
d (2 bits) | register pair of ADIW, SBIW: 24 plus twice the field | r25:r24, X, Y, Z |
d (4 bits) | MOVW: twice the field | even registers |
K | constant: 8 bits (split in two nibbles) or 6 bits (ADIW, SBIW) or 4 bits (DES) | 0 to 255, 0 to 63, 0 to 15 |
k | jump offset in words: 7 bits (branches), 12 bits (RJMP, RCALL), signed; 22-bit word address (JMP, CALL: 6 bits in the first word, 16 in the second) | -64 to +63; -2048 to +2047; 0 to 4 M words |
A | I/O register address: 6 bits (IN, OUT) or 5 bits (SBI, CBI, SBIS, SBIC) | 0x00 to 0x3F; 0x00 to 0x1F |
b, s | bit number of a register or I/O register, or of SREG | 0 to 7 |
q | displacement of LDD, STD: 6 bits split in three places | 0 to 63 |
The families of encodings
| Bits 15 to 12 | Instructions |
|---|---|
0000 | NOP, MOVW, MULS, MULSU, FMUL, FMULS, FMULSU, then CPC, SBC, ADD (two registers, bits 11 to 10) |
0001 | CPSE, CP, SUB, ADC |
0010 | AND, EOR, OR, MOV |
0011 to 0111 | CPI, SBCI, SUBI, ORI, ANDI (register and an 8-bit constant) |
10q0 | LDD, STD with Y or Z and a displacement (also LD, ST when it is 0) |
1001 000d, 1001 001d | LDS, STS (two words), LD, ST with X, Y, Z and increment or decrement, LPM, ELPM, POP, PUSH, and the XMEGA XCH, LAS, LAC, LAT |
1001 010d | one-register operations (COM, NEG, SWAP, INC, ASR, LSR, ROR, DEC), the SREG instructions BSET, BCLR, IJMP, EIJMP, ICALL, EICALL, RET, RETI, SLEEP, BREAK, WDR, LPM, ELPM, SPM, DES, and JMP, CALL (two words) |
1001 0110 to 1001 11 | ADIW, SBIW, CBI, SBIC, SBI, SBIS, MUL |
1011 | IN, OUT |
1100, 1101 | RJMP, RCALL |
1110 | LDI |
1111 | BRBS, BRBC, BLD, BST, SBRC, SBRS |
Skip instructions and the length of the next instruction
CPSE, SBRC, SBRS, SBIC and SBIS skip the instruction that follows when their condition holds. The skipped instruction may be
one word or two (LDS, STS, JMP, CALL), so where the skip lands, and how many cycles it takes (2 or 3 instead of 1), depends on the
next instruction’s length. The disassembler looks at the next word: it gives the target as the address after that instruction and the cycles of both outcomes. On a
core without JMP and CALL those encodings are not instructions, so a skip over one counts one word.
The reduced core
The reduced core (ATtiny4, 5, 9, 10, 20, 40) has registers r16 to r31 only and reuses encodings. Its LDS and STS are one word, 1010 0kkk dddd kkkk and
1010 1kkk rrrr kkkk: they take the place of LDD and STD with a displacement, which the core does not have. The 7-bit field is the data space address
0x40 plus k (so addresses 0x40 to 0xBF, which is where its I/O registers and SRAM are). llvm writes the raw field instead (lds r16, 0 for the data address 0x40); the decoder writes the address.
Encodings that are no instruction
Some words are no instruction on any AVR core: for example 1001 000d dddd 0011 and 1001 000d dddd 1000 and the unused patterns of the
1001 0101 group (every word is checked against llvm on the overview page’s list). The disassembler writes them as .word 0x… and marks them reserved. (The unassigned 1001 000d dddd 1000 is read as
LD Rd,Y by llvm; the manual has LD Rd,Y only as LDD Rd,Y+0.) Words that another core defines are unavailable instead: they are decoded and named,
and the status says that the core chosen does not have them.
Not described
- The bit pattern of every instruction is on its own page (as the first line of each group’s table); the patterns are those of the manual.
- What the real silicon does with the reserved encodings (some devices execute them as
NOP).