3

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:

arm-none-eabi-objdump -b binary --adjust-vma=0x08000000 --start-address=0x08000002 \
  -marm --disassembler-options=force-thumb -D binary_program.bin > /tmp/binary_program-bin.s

First, I tested a loop of instructions like this:

adds    r0, r0, #255

and I got in the .s file

 80002e4:   30ff        adds    r0, #255    ; 0xff

After a long search in the ARM manual (and I hope I found the correct one), I could map that binary as:

instruction: 001_10_000_11111111
bit mask:    111_11_198_76543210
             543_21_0

where

  • 111 = "Add, subtract, compare, move (one low register and immediate)", page F3-7301
  • 10 = "ADD, ADDS (immediate)", version T2 is at page F5-7453
  • 000 = r0, source and destination register
  • 11111111 = 255, the immediate operand

This, IIUC, is Thumb-2. So far so good, but the problem is that other instructions, which are not representable with Thumb-2, get mapped to Thumb-3, like

adds    r0, r0, #256

which becomes

 80002e4:   f510 7080   adds.w  r0, r0, #256    ; 0x100

Obviously this is no more T2, and the bit encoding should be something like

      i 0 op1  S Rn   0 imm3 Rd   imm8
11110_1_0_1000_1_0000_0_111__0000_10000000
33222_2_2_2222_2_1111_1_111__1198_76543210
10987_6_5_4321_0_9876_5_432__10

as reported at "Data-processing (modified immediate)", pages F3-7310 and F3-7311. This lead me to pages F5-7452 to 55, "ADD, ADDS (immediate)". Searching a lot, I found it should be T3: the mnemonic matches (adds.w). This would mean the processor expands the bits 11:0 like this:

  1. it concatenates a 1 with the bits 6:0, 1 0000000
  2. extends with 0s to get a 32 bit word: 00000000000000000000000010000000
  3. it rotates right the integer of the amount specified in bits 11:7, which is 11111, or 31, getting 00000000000000000000000100000000 = 256.

The point is, since I'm using the same compiler for both the codes, and they end up to use different ISAs to translate the instructions, how can I tell which one is which, without dwelling the depths of the ARM manual every time?

Thanks!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.