Words
An instruction is a 16-bit word, optionally followed by one or two more words that hold an operand’s offset, address or immediate value. The first word says what the instruction is and how each operand is addressed; the extra words follow in this order: the source operand’s word first, then the destination operand’s. So an instruction is 2, 4 or 6 bytes long. The disassembler decodes at every even address, with the first column the disassembly from the start of the region.
Format I: two operands
Bits 15 to 12 are the opcode (4 to F):
oooo ssss A B aa dddd — ssss source register (bits 11 to 8), A destination mode (bit 7, Ad), B byte/word (bit 6: 1 = .B), aa source mode (bits 5 and 4, As), dddd destination register (bits 3 to 0).
| Opcode | Instruction | Opcode | Instruction |
|---|---|---|---|
4 | MOV | A | DADD |
5 | ADD | B | BIT |
6 | ADDC | C | BIC |
7 | SUBC | D | BIS |
8 | SUB | E | XOR |
9 | CMP | F | AND |
Format II: one operand
0001 00oo o B aa rrrr — bits 15 to 10 are 000100, ooo (bits 9 to 7) the opcode, B byte/word (bit 6), aa the mode (bits 5 and 4), rrrr the register.
ooo | Instruction | Word | Notes |
|---|---|---|---|
| 0 | RRC | 0x1000 + … | byte or word |
| 1 | SWPB | 0x1080 + … | word only |
| 2 | RRA | 0x1100 + … | byte or word |
| 3 | SXT | 0x1180 + … | word only |
| 4 | PUSH | 0x1200 + … | byte or word |
| 5 | CALL | 0x1280 + … | word only |
| 6 | RETI | 0x1300 exactly | no operand |
| 7 | not an instruction on the 16-bit CPU (on the MSP430X, 0x1380 to 0x13FF hold CALLA forms) | ||
The byte form of SWPB, SXT and CALL is not an instruction: llvm and the decoder both reject it (status reserved).
Jumps
001 ccc oooooooooo — bits 15 to 13 are 001, ccc (bits 12 to 10) the condition, and the low ten bits a signed offset in words. The target is the address of the next instruction plus twice the offset: PC + 2 + 2 × offset, a range of −512 to +511 words. Every jump takes two cycles, taken or not.
ccc | Instruction | Jumps if |
|---|---|---|
| 000 | JNE / JNZ | Z = 0 |
| 001 | JEQ / JZ | Z = 1 |
| 010 | JLO / JNC | C = 0 |
| 011 | JHS / JC | C = 1 |
| 100 | JN | N = 1 |
| 101 | JGE | N = V |
| 110 | JL | N ≠ V |
| 111 | JMP | always |
The addressing modes
The source has two mode bits (As), the destination one (Ad), so a destination can use only the first two rows. “Rn” is the register in the instruction.
| As | Ad | Mode | Written | Meaning | Extra word |
|---|---|---|---|---|---|
| 00 | 0 | Register | Rn | the register | no |
| 01 | 1 | Indexed | X(Rn) | the word or byte at Rn + X (X signed 16 bits) | X |
| 01 | 1 | Symbolic (Rn = PC) | EDE | the address of the extra word + X: position-independent code. The disassembler writes the address it reaches. | X |
| 01 | 1 | Absolute (Rn = SR) | &EDE | the address X itself | X |
| 10 | — | Indirect register | @Rn | the memory at the address in Rn (source only) | no |
| 11 | — | Indirect autoincrement | @Rn+ | as above, then Rn is increased by 1 (byte) or 2 (word). Source only. | no |
| 11 | — | Immediate (Rn = PC) | #N | the extra word itself (@PC+) | N |
The constant generators
R2 and R3 in certain modes give constants without an extra word, which is why MOV #0,R5 is two bytes and MOV #1234,R5 four.
| Register | As | Constant |
|---|---|---|
| R2 (SR) | 10 | #4 |
| R2 (SR) | 11 | #8 |
| R3 (CG2) | 00 | #0 |
| R3 (CG2) | 01 | #1 (no extra word) |
| R3 (CG2) | 10 | #2 |
| R3 (CG2) | 11 | #−1 (0xFFFF for a word, 0xFF for a byte) |
R2 with As = 00 is the status register itself, with 01 the absolute mode. The one-operand instructions that write their operand (RRC, RRA, SWPB, SXT, and CALL) cannot store into a constant, so for R2 and R3 in modes 10 and 11 the disassembler writes the encoded mode
(rrc @r2), as llvm does, with a note; PUSH writes the constant (push #4). A source operand of R3 in register mode of a one-operand instruction is written r3.
Cycles
The cycle counts of the 16-bit CPU (the viewer tabulates these, and no others), from the user’s guide:
| Format I source | Destination register (not PC) |
|---|---|
| Register, constant generator | 1 |
@Rn, @Rn+, #N | 2 |
X(Rn), symbolic, absolute | 3 |
| Format II | Rn | @Rn | @Rn+ | #N | X(Rn), symbolic, absolute |
|---|---|---|---|---|---|
RRC, RRA, SWPB, SXT | 1 | 3 | 3 | — | 4 |
PUSH | 3 | 4 | 4 | 4 | 5 |
CALL | 4 | 4 | 5 | 5 | 5 |
RETI | 5 | ||||
A memory destination adds cycles (a one-word register-to-memory MOV is 4) and a PC destination adds one; those are in the manual and not in the viewer. The viewer’s timing text says so.
Encodings that are no instruction
On the 16-bit CPU the words 0x0000 to 0x0FFF (the MSP430X address instructions), 0x1380 to 0x13FF, 0x1400 to 0x1FFF and a few inside the one-operand group are not instructions.
They are written .word 0x… with the status reserved. (The emulator of the LaunchPad treats 0x0000 to 0x0FFF as NOP; the data sheets do not define them.)
Not described
- The cycles of memory destinations, of PC destinations and of the MSP430X.
- What the silicon does with the reserved encodings.