68000 Instruction Set – Overview

Introduction

These pages describe the Motorola 68000 family and the disassembler the explorer uses for it (explorer/cpu/m68k/, our own code). The 68000 (1979) runs the Sega Mega Drive, the early Macintosh, the Amiga, the Atari ST and many arcade boards. It is big-endian, has 16 registers of 32 bits and works in 16-bit words: an instruction is an opcode word followed by up to ten more extension words, so it is always an even number of bytes, 2 to 22 on the 68020 and later, and starts on an even address. The viewer nevertheless decodes at every byte, like the other CPU views; the odd offsets show what the bytes would be if the code started there.

The same instruction set grew with each chip, and ColdFire is a cut-down, embedded descendant. The decoder takes the model as a choice; an instruction that exists on a later model only is shown as such, not guessed at.

The models

Status of an instruction

Every instruction the viewer shows carries a status for the chosen model, drawn in its own colour and also written as text:

• documented: a defined instruction of this model. This includes ILLEGAL ($4AFC), the one opcode the manual defines to take the illegal-instruction exception;
• unavailable: an instruction of a later model (a bit-field instruction decoded as 68000, MOVEC on the 68000). The chip takes the illegal-instruction exception on the opcode word, so the viewer shows it as one word (.dc.w);
• illegal: an opcode that is not an instruction on any model of the family, or an instruction with a field the manual reserves (a reserved index-extension word, a reserved MOVEC control register);
• reserved: the A-line ($Axxx) and F-line ($Fxxx) opcodes that this model does not execute: each takes its own exception (vector 10 and vector 11), which operating systems use for system calls (the classic Mac OS) and for emulating instructions in software.

The 68000 has no undocumented opcodes that the decoder tells apart from the illegal ones: Motorola defined every encoding it left over as an exception, and the viewer shows the exception it takes. Instructions that a later model leaves to software (the 68040 and 68060 transcendental FPU functions, the 68060’s MOVEP and 64-bit MUL) are marked emulated in the instruction’s notes.

The decoder and its options

For each instruction the decoder returns the address, the bytes, the length, the mnemonic with its size suffix (move.w), the operands, the target of a branch or jump, the absolute and PC-relative addresses it names, the registers it reads and writes, whether it reads or writes memory, the condition codes it reads and changes (X N Z V C), whether it is privileged, the exception vector a trap takes and a one-line summary. Cycle counts are not given: no timing table was available to check them against.

The Mega Drive viewer, the ELF viewer (EM_68K, EM_COLDFIRE) and later the Amiga, Atari ST and classic Mac viewers share this decoder.

How it was checked

There is no 68000 target in the LLVM on this machine, so the decoder was compared with an independent one: the disassembler of the Musashi 68000 emulator core (m68kdasm.c, as used in the Out Run emulator build under emulators.org), compiled unchanged. Every opcode word $0000 to $FFFF was decoded with eight different tails of extension words for the 68000, 68010, 68020, 68030 and 68040 (5,269,504 cases with the sweeps below); the length and the text had to agree. Added to that: every FPU command word with eight effective addresses, and 700 opcodes with 512 full-format index extension words on the 68020 and later. 4,111,172 cases agree exactly and none disagree without a reason. The rest fall in named classes, each argued: Musashi decodes the 68851 on the 68000 and 68040, prints only 16 bits of a 32-bit displacement, shows a scale factor on the 68000, treats coprocessors 2 to 7 generically, has no FTST operand rule or rounding-precision FPU opcodes, misspells a few FPU mnemonics, and accepts reserved encodings that this decoder marks illegal or reserved. A hand-written table of 312 checks from the manual (test-m68k-tables.mjs) covers the rest, and the oracle caught five real mistakes in the first version (TST on the 68000 is data-alterable only; CMPI takes PC-relative modes from the 68010; the PFLUSH opcode order; FPU command class 1 is reserved).

Not checked by an independent decoder: the MMU (Musashi’s own is too incomplete to use), ColdFire (no oracle at all) and the 68060’s list of software-emulated instructions.

Sources

• M68000 Family Programmer’s Reference Manual (M68000PRM) – Motorola/NXP: the instruction set of every model, effective addresses, coprocessor protocol
• MC68040 User’s Manual and the MC68060 User’s Manual – the on-chip FPU and MMU, MOVE16, CINV, CPUSH
• ColdFire Family Programmer’s Reference Manual – the ColdFire instruction set
• Musashi – Karl Stenerud’s 68000 emulator, the independent decoder used for the check

Not described

Known, not yet covered

• Reference: cycle counts for any model; the stack frames of the exceptions; bus and address errors; the 68881/68882 floating-point control-register details and the exact condition-code rules of the transcendental functions; the 68851-only MMU instructions PVALID, PFLUSHR, PFLUSHS, PCMPW; the ColdFire MAC and EMAC units and the V4e FPU.
• Viewer: the ColdFire decode checks which instructions exist but not every operand-size and addressing-mode limit of the ISA_A, ISA_B and ISA_C revisions; user coprocessors 2 to 7 are shown as line-F traps because only the coprocessor knows how long a general command is.

Unknown

• Reference: the ColdFire list of existing instructions and the opcodes of its extra instructions were written from memory of the ColdFire Family Programmer’s Reference Manual and not checked against a second source.