How to decode ARMv7 instructions?

Question

I'm trying to understand ARM instruction encoding.

The following image shows C code along with its corresponding assembly instructions:

I looked at the ARMv7 reference manual. However, I couldn't find the relationship between the machine code and the corresponding assembly instruction.

For example,

I couldn't relate the machine code

F1AD0D08

to the assembly instruction

sub.w sp, sp, #8

Could you help me with this?

======================================================

Based on the answers and after looking at the reference manual, I added the following information.

The processor name is Cortex-M4F.

The processor architecture of the microcontroller I use is ARMv7.

Specifically, the microcontroller profile employed is ARMv7-M.

From the manual:

ARMv7-M The microcontroller profile for systems supporting only the Thumb instruction set, and where overall size and deterministic operation for an implementation are more important than absolute performance.

Answer 1

The ARMv7-M reference manual does not have a decode lookup table, but the encoding for each instruction is listed.

In the specific manual you have linked, you will find this in the section A6.7 - Alphabetical list of ARMv7-M Thumb instruction.

This contains - as stated - a list of every instruction, and their corresponding binary encoding. For example, page A6-16 has the binary encoding for the ADC (immediate) instruction. We can see that it starts with 11110... and spans two words.

The problem is going "backwards". The manual does indeed contain all the necessary information, but it is difficult to search. The disassembler has the data structures in place to do that for you, and if you want a table and do it manually, I suggest looking at the source code files for an ARM disassembler, for example GNU binutils.

Answer 2

In the ARMv7-m ARM that I am looking at encoding T3 for subtract immediate which is supported by ARMv7-M architecture is in the form

SUB{S}<c>.W <Rd>,<Rn>,#<const>

the bit pattern 11110i01101S.... which matches with the 0xF1A of the instruction, sp is 13 and the two instances of 0XD in the encoding line up with that along with the immediate #8.

If you look at LDR (literal) the encoding is 0x4800 with a register and immediate. this instruction as documented does a pc relative load, so the pc is implied. likewise this is a 32 bit load, so when we assume 32 bit alignment the offset makes sense 0x34 is 110100, being 32 bit aligned we dont need the lower two bits they burn instruction space so 1101 which is a 0x0D giving 0x490D as the encoding.

It is all right there in the document you are looking at.

Answer 3

http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0210c/CACCCHGF.html

490D : the '4' = 0100 and '9' = 1001, so the top five bits are 01001. Looking down the table shows that as "PC relative load". The next three bits are 001 for 'Rd', the destination register. The operand is 'D', which multiplied by 4 to count words is 0x34.

F1AD0D08 is a bit strange. Someone else can try that one.

Answer 4

I thought I'd mention at this late date that the current version of the ARMv7m Architecture Reference Manual does have Chapter 5 "The Thumb Instruction Set Encoding" that is helpful for decoding CM4 instructions. It's still pretty difficult, because essentially the instruction set is really ugly and not at all regular :-(

But for your F1AD0D08 (1111 0001 1010 1101 0D 08):

If bits [15:11] of the halfword being decoded take any of the following values, the halfword is the first halfword of a 32-bit instruction: [goto "32-bit Thumb instruction encoding" on page n]

111 10 x1xxxxx -> Data processing (plain binary immediate) [Page a5-141]

111 10 x1 01010 -> SUB (immediate) [page a7-402]

(that's the individual subtract instruction description. We see that we match enoding T4) 11110 i1 01010 1101 ... -> oops. "if Rn = 1101, see SUB (SP minus immediate) [a7-406]

So now we're at encoding T3 of SUB (SP minus immediate) 11110 i1 01010 1101 0 imm3 rd imm8

Where we put together a 12bit immediate value i:imm3:imm8, which in your case is 8, and Rd is 0d (r13, or SP.)

Ta Da!