EE 308 Spring 2014

• MC9S12 Assembler Directives

• A Summary of MC9S12 Instructions
• Disassembly of MC9S12 op codes
o Review of Addressing Modes
o Which branch instruction to use (signed vs unsigned)
o Using X and Y registers as pointers
o Hand assembling a program
o How long does a program take to run?
o Assembler directives
o How to disassemble an MC9S12 instruction sequence

Summary of HCS12 addressing modes

ADDRESSING MODES
 EE 308 Spring 2014

A few instructions have two effective addresses:

• MOVB #$AA,$1C00 Move byte 0xAA (IMM) to address

$1C00 (EXT)
• MOVW 0,X,0,Y Move word from address pointed to by
X (IDX) to address pointed to by Y
(IDX)

A few instructions have three effective addresses:

• BRSET FOO,#$03,LABEL Branch to LABEL (REL) if bits

#$03 (IMM) of variable FOO
(EXT) are set.
 EE 308 Spring 2014

Using X and Y as Pointers

• Registers X and Y are often used to point to data.

• To initialize pointer use

ldx #table
not

ldx table

• For example, the following loads the address of table ($1000)

into X; i.e., X will point
to table:

ldx #table ; Address of table ⇒ X

The following puts the first two bytes of table ($0C7A) into X. X
will not point to table:

ldx table ; First two bytes of table ⇒ X

• To step through table, need to increment pointer after use

ldaa 0,x
inx

or

ldaa 1,x+
 EE 308 Spring 2014

Which branch instruction should you use?

Branch if A > B
Is 0xFF > 0x00?

If unsigned, 0xFF = 255 and 0x00 = 0,

so 0xFF > 0x00

If signed, 0xFF = −1 and 0x00 = 0,

so 0xFF < 0x00

Using unsigned numbers: BHI (checks C bit of CCR)

Using signed numbers: BGT (checks V bit of CCR)

For unsigned numbers, use branch instructions which check C bit

For signed numbers, use branch instructions which check V bit

 EE 308 Spring 2014

Hand Assembling a Program

To hand-assemble a program, do the following:

1. Start with the org statement, which shows where the first byte of
the program will go into memory.
(e.g., org $2000 will put the first instruction at address $2000.)

2. Look at the first instruction. Determine the addressing mode

used.
(e.g., ldab #10 uses IMM mode.)

3. Look up the instruction in the MC9S12 S12CPUV2 Reference

Manual, find the appropriate Addressing Mode, and the Object
Code for that addressing mode. (e.g., ldab IMM has object code
C6 ii.)

• Table A.1 of the S12CPUV2 Reference Manual has a

concise summary of the instructions, addressing modes,
op-codes, and cycles.

4. Put in the object code for the instruction, and put in the
appropriate operand. Be careful to convert decimal operands to hex
operands if necessary. (e.g., ldab #10 becomes C6 0A.)

5. Add the number of bytes of this instruction to the address of the

instruction to determine the address of the next instruction.
(e.g., $2000 + 2 = $2002 will be the starting address of the next
instruction.)
 EE 308 Spring 2014

org $2000
ldab #10
loop: clra
dbne b,loop
swi

Freescale HC12-Assembler
(c) Copyright Freescale 1987-2010

Abs. Rel. Loc Obj. code Source line

---- ---- ------ --------- -----------
1 1
2 2 0000 2000 prog: equ $2000
3 3 org prog
4 4 a002000 C60A ldab #10
5 5 a002002 87 loop: clra
6 6 a002003 0431 FC dbne b,loop
7 7 a002006 3F swi
EE 308 Spring 2014
EE 308 Spring 2014
EE 308 Spring 2014
EE 308 Spring 2014
 EE 308 Spring 2014

MC9S12 Cycles

• MC9S12 works on 48 MHz clock

• A processor cycle takes 2 clock cycles – P clock is 24 MHz

• Each processor cycle takes 41.7 ns (1/24 μs) to execute

• An instruction takes from 1 to 12 processor cycles to execute

• You can determine how many cycles an instruction takes by

looking up the CPU cycles for that instruction in the Reference
Manual.

– For example, LDAB using the IMM addressing mode

shows one CPU cycle (of type P).

– LDAB using the EXT addressing mode shows three CPU

cycles (of type rPO).

– Section 6.6 of the S12CPUV2 Reference Manual explains

what the HCS12 is doing during each of the different types of
CPU cycles.

2000 org $2000 ; Inst Mode Cycles

2000 C6 0A ldab #10 ; LDAB (IMM) 1
2002 87 loop:clra ; CLRA (INH) 1
2003 04 31 FC dbne b,loop ; DBNE (REL) 3
2006 3F swi ; SWI 9
 EE 308 Spring 2014

The program executes the ldab #10 instruction once. It then goes
through the loop 10 times (which has two instructions, one with
one cycle and one with three cycles), and finishes with the swi
instruction (which takes 9 cycles).

Total number of cycles:

1 + 10 × (1 + 3) + 9 = 50

50 cycles = 50 × 41.7 ns/cycle = 2.08 μs

EE 308 Spring 2014
 EE 308 Spring 2014

Assembler Directives

• In order to write an assembly language program it is necessary to

use assembler directives.

• T hese are not instructions which the HC12 executes but are
directives to the assembler program about such things as where to
put code and data into memory.

• CodeWarrior has a large number of assembler directives, which

can be found in the CodeWarrior help section.

• We will use only a few of these directives. (Note: In the

following table, [ ] means an optional argument.) Here are the ones
we will need:
 EE 308 Spring 2014

Directive Description Example

Name
equ Give a value to a symbol len: equ 100
org Set starting value of location org $1000
counter where code or data
will go
dc.b Allocate and initialize storage var: dc.b 2,18
for 8-bit variables. name: dc.b “Jane”
Place the bytes in successive
memory locations
dc.w Allocate and initialize storage var: dc.w $ABCD
for 16-bit variables.
Place the bytes in successive
memory locations
ds.b Allocate specified number of Table: ds.b 10
8-bit storage places

ds.w Allocate specified number of table: ds.w 50

16-bit storage spaces

dcb.b Fill memory with a given init_data: dc.b 100,0

value:
The first value is the number
of bytes to fill.
The second number is the
value to put into memory
 EE 308 Spring 2014

Using labels in assembly programs

A label is defined by a name followed by a colon as the first thing

on a line. When the label is referred to in the program, it has the
numerical value of the location counter when the label was
defined.

Here is a code fragment using labels and the assembler directives

dc and ds:

org $2000
table1: dc.b $23,$17,$f2,$a3,$56
table2: ds.b 5
var: dc.w $43af

The CodeWarrior assembler produces a listing file (.lst). Here is

the listing file from the assembler:

Freescale HC12-Assembler
(c) Copyright Freescale 1987-2009
Abs. Rel. Loc Obj. code Source line
---- ---- ------ --------- ---------------------------
1 1 org $2000
2 2 a002000 2317 F2A3 table1: dc.b $23,$17,$f2,$a3,$56
002004 56
3 3 a002005 table2: ds.b 5
4 4 a00200A 43AF var: dc.w $43af
5 5

Note that table1 is a name with the value of $2000, the value of
the location counter defined in the org directive. Five bytes of data
are defined by the dc.b directive, so the location counter is
increased from $2000 to $2005.
 EE 308 Spring 2014

Note that table2 is a name with the value of $2005. Five bytes of
data are set aside for table2 by the ds.b 5 directive. The as12
assembler initialized these five bytes of data to all zeros. var is a
name with the value of $200a, the first location after table2.
 EE 308 Spring 2014

HC12 Instructions

1. Data Transfer and Manipulation Instructions — instructions

which move and manipulate data (S12CPUV2 Reference Manual,
Sections 5.3, 5.4, and 5.5).

• Load and Store — load copy of memory contents into a register;

store copy of register contents into memory.
LDAA $2000 ; Copy contents of addr $2000 into A
STD 0,X ; Copy contents of D to addrs X and X+1

• Transfer — copy contents of one register to another.

TBA ; Copy B to A
TFR X,Y ; Copy X to Y

• Exhange — exchange contents of two registers.

XGDX ; Exchange contents of D and X
EXG A,B ; Exchange contents of A and B

• Move — copy contents of one memory location to another.

MOVB $2000,$20A0 ; Copy byte at $2000 to $20A0
MOVW 2,X+,2,Y+ ; Copy two bytes from address held
; in X to address held in Y
; Add 2 to X and Y

2. Arithmetic Instructions — addition, subtraction, multiplication,

division (S12CPUV2 Reference Manual, Sections 5.6, 5.8 and
5.12).
ABA ; Add B to A; results in A
SUBD $20A1 ; Subtract contents of $20A1 from D
INX ; Increment X by 1
MUL ; Multiply A by B; results in D
 EE 308 Spring 2014

3. Logic and Bit Instructions — perform logical operations

(S12CPUV2 Reference Manual, Sections 5.9, 5.10, 5.11, 5.13
and 5.14).

• Logic Instructions
ANDA $2000 ; Logical AND of A with contents of
; $2000
EORB 2,X ; Exclusive OR B with contents of
; address (X+2)

• Clear, Complement and Negate Instructions

NEG -2,X ; Negate (2’s comp) contents of
; address (X-2)
CLRA ; Clear ACC A

• Bit manipulate and test instructions — work with bits of a

register or memory.
BITA #$08 ; Check to see if Bit 3 of A is set
BSET $0002,#$18 ; Set bits 3 and 4 of address $0002

• Shift and rotate instructions

LSLA ; Logical shift left A
ASR $1000 ; Arithmetic shift right value at address
; $1000
 EE 308 Spring 2014

4. Compare and test instructions — test contents of a register or

memory (to see if zero, negative, etc.), or compare contents of a
register to memory (to see if bigger than, etc.) (S12CPUV2
Reference Manual, Section 5.9).

TSTA ; (A)-0 -- set flags accordingly

CPX #$8000 ; (X) - $8000 -- set flags accordingly

5. Jump and Branch Instructions — Change flow of program (e.g.,

goto, it-then-else, switch-case) (S12CPUV2 Reference Manual,
Sections 5.19, 5.20 and 5.21).

JMP L1 ; Start executing code at address label

; L1
BEQ L2 ; If Z bit set, go to label L2
DBNE X,L3 ; Decrement X; if X not 0 then goto L3
BRCLR $1A,#$80,L4 ; If bit 7 of addr $1A clear, go to
; label L4
JSR sub1 ; Jump to subroutine sub1
RTS ; Return from subroutine

6. Interrupt Instructions — Initiate or terminate an interrupt call

(S12CPUV2 Reference Manual, Section 5.22).

• Interrupt instructions
SWI ; Initiate software interrupt
RTI ; Return from interrupt
 EE 308 Spring 2014

7. Index Manipulation Instructions — Put address into X, Y or SP,

manipulate X, Y or SP (S12CPUV2 Reference Manual, Section
5.23).

ABX ; Add (B) to (X)

LEAX 5,Y ; Put address (Y) + 5 into X

8. Condition Code Instructions — change bits in Condition Code

Register (S12CPUV2 Reference Manual, Section 5.26).

ANDCC #$f0 ; Clear N, Z, C and V bits of CCR

SEV ; Set V bit of CCR

9. Stacking Instructions — push data onto and pull data off of

stack (S12CPUV2 Reference Manual, Section 5.24).

PSHA ; Push contents of A onto stack

PULX ; Pull two top bytes of stack, put into X

10. Stop and Wait Instructions — put MC9S12 into low power
mode (S12CPUV2 Reference Manual, Section 5.27).

STOP ; Put into lowest power mode

WAI ; Put into low power mode until next interrupt

11. Null Instructions

NOP ; No operation
BRN ; Branch never
 EE 308 Spring 2014

12. Instructions we won’t discuss or use — BCD arithmetic, fuzzy

logic, minimum and maximum, multiply-accumulate, table
interpolation (S12CPUV2 Reference Manual, Sections 5.7, 5.16,
5.17, and 5.18).

Disassembly of an HC12 Program

• It is sometimes useful to be able to convert HC12 op codes into

mnemonics.

For example, consider the hex code:

ADDR DATA
---------------------------------------------------------
1000 C6 05 CE 20 00 E6 01 18 06 04 35 EE 3F

• To determine the instructions, use Table A-2 of the HCS12 Core

Users Guide.

– If the first byte of the instruction is anything other than $18,

use Sheet 1 of Table A.2. From this table, determine the
number of bytes of the instruction and the addressing mode.
For example, $C6 is a two-byte instruction, the mnemonic is
LDAB, and it uses the IMM addressing mode. Thus, the two
bytes C6 05 is the op code for the instruction LDAB #$05.

- If the first byte is $18, use Sheet 2 of Table A.2, and do the
same thing. For example, 18 06 is a two byte instruction, the
mnemonic is ABA, and it uses the INH addressing mode, so
there is no operand. Thus, the two bytes 18 06 is the op code
for the instruction ABA.
 EE 308 Spring 2014

- Indexed addressing mode is fairly complicated to

disassemble. You need to use Table A.3 to determine the
operand. For example, the op code $E6 indicates LDAB
indexed, and may use two to four bytes (one to three bytes in
addition to the op code). The postbyte 01 indicates that the
operand is 0,1, which is 5-bit constant offset, which takes
only one additional byte. All 5-bit constant offset, pre and
post increment and decrement, and register offset instructions
use one additional byte. All 9-bit constant offset instructions
use two additional bytes, with the second byte holding 8 bits
of the 9 bit offset. (The 9th bit is a direction bit, which is
held in the first postbyte.) All 16-bit constant offset
instructions use three postbytes, with the 2nd and 3rd holding
the 16-bit unsigned offset.

– Transfer (TFR) and exchange (EXG) instructions all have

the op code $B7. Use Table A.5 to determine whether it is
TFR or an EXG, and to determine which registers are being
used. If the most significant bit of the postbyte is 0, the
instruction is a transfer instruction.

– Loop instructions (Decrement and Branch, Increment

and Branch, and Test and Branch) all have the op code $04.
To determine which instruction the op code $04 implies, and
whether the branch is positive (forward) or negative
(backward), use Table A.6. For example, in the sequence 04
35 EE, the 04 indicates a loop instruction. The 35 indicates it
is a DBNE X instruction (decrement register X and branch if
result is not equal to zero), and the direction is backward
(negative). The EE indicates a branch of -18 bytes.
–
 EE 308 Spring 2014

• Use up all the bytes for one instruction, then go on to the

next instruction.

C6 05 ⇒ LDAB #$05 two-byte LDAB, IMM

addressing mode

CE 20 00 ⇒ LDX #$2000 three-byte LDX, IMM

addressing mode
E6 01 ⇒ LDAB 1,X two to four-byte LDAB,
IDX addressing mode. Operand
01 => 1,X, a 5b constant offset
which uses only one postbyte
18 06 ⇒ ABA two-byte ABA, INH addressing
mode
04 35 EE ⇒ DBNE X,(-18) three-byte loop instruction
Postbyte 35 indicates DBNE X,
negative
3F ⇒ SWI one-byte SWI, INH addressing
mode
EE 308 Spring 2014
EE 308 Spring 2014
EE 308 Spring 2014
EE 308 Spring 2014
EE 308 Spring 2014