68000 Instruction Set – ColdFire

The embedded descendant: what it dropped, what it added

What ColdFire is

ColdFire (Motorola, then Freescale and NXP) is a variable-length RISC-style core that keeps the 68000’s programmer’s model and instruction encoding, so much 68000 code runs unchanged, but it drops instructions that cost hardware, limits operand sizes and addressing modes on many of the rest, and adds a few new ones. The revisions are named by the instruction set architecture they implement: ISA_A (V2, e.g. MCF5206), ISA_A+ (V3) and ISA_B (V4, with ISA_C after it). The decoder offers cfv2, cfv3 and cfv4. In an ELF file the revision comes from the e_flags ISA field (EM_COLDFIRE = 52).

Instructions the 68000 has and ColdFire does not

A word that is one of these on the 68000 is an unavailable instruction here (the status says so, and the note names it): ABCD, SBCD, NBCD and PACK/UNPK (no BCD), MOVEP, DBcc, CHK, EXG, RTR, TRAPV, RESET, RTD, BKPT, MOVES, the bit-field instructions, CAS and CAS2, CMP2 and CHK2, CALLM and RTM, the coprocessor interface and the 68040 cache and MMU opcodes; also the memory-to-memory forms ADDX/SUBX on memory and CMPM. The list is written from the ColdFire Family Programmer’s Reference Manual’s instruction summary as remembered.

Instructions ColdFire adds

MnemonicOpcodeRevisionWhat it does
MVS0111 Dn 1 00 ea (byte), 0111 Dn 1 01 ea (word)ISA_BMove with sign extension to a long word in Dn. On the 68000 these opcodes are illegal.
MVZ0111 Dn 1 10 ea (byte), 0111 Dn 1 11 ea (word)ISA_BMove with zero extension.
MOV3Q1010 qqq 1 01 eaISA_BMove a 3-bit immediate (−1, or 1 to 7) to a long-word destination. In the A-line of the 68000.
SATS$4C80 | DnISA_B (and A+)Saturate Dn to the 32-bit range if V is set.
BITREV$00C0 | DnISA_A+Reverse the 32 bits of Dn.
BYTEREV$02C0 | DnISA_A+Reverse the four bytes of Dn.
FF1$04C0 | DnISA_A+Find the first one bit: Dn gets its position.
REMS, REMU$4C41 + word (the 32-bit divide form with Dr ≠ Dq)ISA_A+Signed and unsigned remainder.
HALT$4AC8ISA_A+Halt the core (debug). Privileged.
PULSE$4ACCISA_A+Drive a pulse on the debug pins.
TPF$51FA (word operand), $51FB (long operand), $51FC (none): the false TRAPcc formsISA_AA no-op that skips its operand (the opcode is TRAPF on the 68020).
CPUSHL$F428 | cc<<6 | AnISA_A+Push and invalidate a cache line; the same encoding as on the 68040. Privileged.
WDDATA$FB00 | size<<6 | eaISA_AWrite a value to the debug data port.

The ColdFire multiply-accumulate unit (MAC, MSAC, EMAC and their moves, in the A-line), the V4e FPU and the ColdFire’s STLDSR, WDEBUG and INTOUCH instructions are not decoded.

Other differences

  • Addressing: only the brief extension word exists (with the scale from ISA_A); the full word with memory indirection is not available. Bit 8 of the word is ignored.
  • The sizes of many instructions are limited (most arithmetic is long only on ISA_A); the decoder accepts every size the 68000 has and does not flag these.
  • Scc and MOVEM accept fewer modes; TRAP #n and the stack frame differ.
  • The control registers CACR, ACR0 to ACR3, VBR, RAMBAR, ROMBAR, MBAR, SR and PC are named by MOVEC.

Not described

Known, not yet covered

  • Reference: the operand-size and addressing-mode limit of each instruction on ISA_A, A+, B and C; the MAC and EMAC instructions; the V4e FPU.
  • Viewer: only which instructions exist is checked, and only against the manual as remembered, not against an independent decoder or a ColdFire core.

Unknown

  • Reference: whether each revision number above for a new instruction (ISA_A+ or ISA_B) is exactly right: the table is the author’s reading of the manual’s summary.