ARM Instruction Sets and Program

V4. 2008-09-24

Adopted from National Chiao-Tung University

IP Core Design
SOC Consortium Course Material
Outline
qProgrammer’s model
q32-bit instruction set
q16-bit instruction set
qSummary

SOC Consortium Course Material 2

Programmer’s model

SOC Consortium Course Material 3

ARM Ltd
q ARM was originally developed at Acron Computer Limited, of
Cambridge, England between 1983 and 1985.
– 1980, RISC (Reduced Instruction Set Computer) concept at Stanford
and Berkeley universities.
– First RISC processor for commercial use
q 1990 Nov, ARM Ltd was founded
q ARM cores
– Licensed to partners who fabricate and sell to customers.
q Technologies assist to design in the ARM application
– Software tools, boards, debug hardware, application software, bus
architectures, peripherals etc…
q Modification of the acronym expansion to Advanced RISC
Machine.

SOC Consortium Course Material 4

RISC architecture
qBerkeley incorporated a RISC architecture.
qIt had the following key features:
– A fixed (32-bit) instruction size with few formats;
• CISC processors typically had variable length instruction sets with
many formats.
– A load–store architecture were instructions that process
data operate only on registers and are separated from
instructions that access memory;
• CISC processors typically allowed values in memory to be used
as operands in data processing instructions.
– A large register bank of thirty-two 32-bit registers, all of
which could be used for any purpose, to allow the load-
store architecture to operate efficiently;
• CISC register sets were getting larger, but none was this large
and most had different registers for different purposes
SOC Consortium Course Material 5
RISC organization
qHardwired instruction decode logic
– CISC processor used large microcode ROMs to decode
their instructions
qPipelined execution
– CISC processors allowed little, if any, overlap between
consecutive instructions
qSingle-cycle execution
– CISC processors typically took many clock cycles to
completes a single instruction

SOC Consortium Course Material 6

ARM Architecture vs. Berkeley RISC (1/2)

qFeatures used
– Load/Store architecture
– Fixed-length 32-bit instructions
– 3-address instruction formats

f bits n bits n bits n bits

function op 1 addr. op 2 addr. dest. addr.
ADD d, S1, S2 ; d := S1 + S2

SOC Consortium Course Material 7

ARM Architecture vs. Berkeley RISC (2/2)
qFeatures rejected
– Register windows → costly
• Use shadow registers in ARM
– Delay branch
• Badly with branch prediction
– Single-cycle execution of all instructions
• Most single cycle, many other take multiple clock cycles

SOC Consortium Course Material 8

Data Size and Instruction set
qARM processor is a 32-bit architecture
qMost ARM’s implement two instruction sets
– 32-bit ARM instruction set
– 16-bit Thumb instruction set

SOC Consortium Course Material 9

Data Types

qARM processor supports 6 data types

– 8-bits signed and unsigned bytes
– 16-bits signed and unsigned half-word, aligned on 2-byte
boundaries
– 32-bits signed and unsigned words, aligned on 4-byte
boundaries
qARM instructions are all 32-bit words, word-aligned;
Thumb instructions are half-words, aligned on 2-
byte boundaries
qARM coprocessor supports floating-point values

SOC Consortium Course Material 10

The Registers
qARM has 37 registers, all of which are 32 bits long
– 1 dedicated program counter
– 1 dedicated current program status register
– 5 dedicated saved program status registers
– 31 general purpose registers
qThe current processor mode governs which bank is
accessible
– User mode can access
• A particular set of r0 – r12 registers
• A particular r13 (stack pointer, SP) and r14 (link register. LR)
• The program counter, r15 (PC)
• The current program status register, CPSR
– Privileged modes (except system) can access
• A particular SPSR (Saved Program Status Register)
SOC Consortium Course Material 11
Register Banking
r0
usable in user mode
r1
r2
r3 system modes only
r4
r5
r6
r7
r8_fiq
r8
r9 r9_fiq
r10_fiq
r10
r1 1 r11_fiq
r12_fiq r13_irq r13_und
r12 r13_abt
r13_fiq r13_svc r14_irq r14_und
r13 r14_svc r14_abt
r14 r14_fiq
r15 (PC)

SPSR_und
SPSR_abt SPSR_irq
CPSR SPSR_fiq SPSR_svc

fiq svc abort irq undefined

user mode mode mode mode mode mode
SOC Consortium Course Material 12
Program Counter (r15)
qWhen the processor is executing in ARM state:
– All instructions are 32 bits wide
– All instructions must be word-aligned
– Therefore the PC value is stored in bits [32:2] with bits
[1:0] undefined (as instruction cannot be halfword)
qWhen the processor is executing in Thumb state:
– All instructions are 16 bits wide
– All instructions must be halfword-aligned
– Therefore the PC value is stored in bits [32:1] with bit [0]
undefined (as instruction cannot be byte-aligned)

SOC Consortium Course Material 13

Current Program Status Registers (CPSR)

q Condition code flags q Interrupt disable bits

– N: Negative result form ALU – I = 1, disable the IRQ
– Z: Zero result from ALU – F = 1, disable the FIQ
– C: ALU operation Carried out q T Bit
– V: ALU operation oVerflowed – Architecture xT only
– T = 0, processor in ARM state
q Sticky overflow flag – Q – T = 1, processor in Thumb
state
flag
– Architecture 5TE only q Mode bits
– Indicates if saturation has – Specify the processor mode
occurred during certain
operations
SOC Consortium Course Material 14
Saved Program Status Register (SPSR)
qEach privileged mode (except system mode) has
associated with it a SPSR
qThis SPSR is used to save the state of CPSR when
the privileged mode is entered in order that the user
state can be fully restored when the user process is
resumed
qOften the SPSR may be untouched from the time
the privileged mode is entered to the time it is used
to restore the CPSR, but if the privileged supervisor
calls to itself the SPSR must be copied into a
general register and saved

SOC Consortium Course Material 15

Processor Modes
qARM has seven basic operation modes
qMode changes by software control or external
interrupts

SOC Consortium Course Material 16

Privileged Modes
qMost programs operate in user mode. ARM has
other privileges operating modes which are used to
handle exceptions, supervisor calls (software
interrupt), and system mode.
qMore access rights to memory systems and
coprocessors.
qCurrent operating mode is defined by CPSR[4:0].

SOC Consortium Course Material 17

Exceptions
qExceptions are usually used to handle unexpected
events which arise during the execution of a
program, such as interrupts or memory faults, also
cover software interrupts, undefined instruction
traps, and the system reset
qThree groups:
– Exceptions generated as the direct effect of execution an
instruction
• Software interrupts, undefined instructions, and prefetch abort
– Exceptions generated as a side effect of an instruction
• Data aborts
– Exceptions generated externally
• Reset, IRQ and FIQ
SOC Consortium Course Material 18
Exception Entry (1/2)
q When an exception arises, ARM completes the current
instruction as best it can (except that reset exception
terminates the current instruction immediately) and then
departs from the current instruction sequence to handle the
exception which starts from a specific location (exception
vector).
q Processor performs the following sequence:
– Change to the operating mode corresponding to the particular
exception
– Save the address of the instruction following the exception entry
instruction in r14 of the new mode
– Save the old value of CPSR in the SPSR of the new mode
– Disable IRQs by setting bit 7 of the CPSR and, if the exception is a
fast interrupt, disable further faster interrupt by setting bit 6 of the
CPSR

SOC Consortium Course Material 19

Exception Entry (2/2)
– Force the PC to begin execution at the relevant vector address

q Normally the vector address contains a branch to the

relevant routine
q Two banked registers in each of the privilege modes are
used to hold the return address and stack point

SOC Consortium Course Material 20

Exception Return
qOnce the exception has been handled, the user task
is normally resumed
qThe sequence is
– Any modified user registers must be restored from the
handler’s stack
– CPSR must be restored from the appropriate SPSR
– PC must be changed back to the relevant instruction
address
qThe last two steps happen automatically as part of a
single instruction

SOC Consortium Course Material 21

ARM Exceptions
qException handler use r13_<mode> which will
normally have been initialized to point a dedicated
stack in memory, to save some user register for use
as work registers

SOC Consortium Course Material 22

Exception Priorities
qPriority order
– Reset (highest priority)
– Data abort
– FIQ
– IRQ
– Prefetch abort
– SWI, undefined instruction

SOC Consortium Course Material 23

Memory Organization

q Word, half-word alignment (xxxx00 or xxxxx0)

q ARM can be set up to access data in either little-endian or
big-endian format, through they default to little-endian.

SOC Consortium Course Material 24

Features of the ARM Instruction Set
qLoad-store architecture
– Process values which are in registers
– Load, store instructions for memory data accesses
q3-address data processing instructions
qConditional execution of every instruction
qLoad and store multiple registers
qShift, ALU operation in a single instruction
qOpen instruction set extension through the
coprocessor instruction
qVery dense 16-bit compressed instruction set
(Thumb)
SOC Consortium Course Material 25
Coprocessors

– Up to 16 coprocessors can be defined

– Expands the ARM instruction set
– Each coprocessor can have up to 16 private registers of
any reasonable size
– Load-store architecture
SOC Consortium Course Material 26
Thumb
qThumb is a 16-bit instruction set
– Optimized for code density from C code
– Improved performance for narrow memory
– Subset of the functionality of the ARM instruction set
qCore has two execution states – ARM and Thumb
– Switch between them using BX instruction
qThumb has characteristic features:
– Most Thumb instruction are executed unconditionally
– Many Thumb data process instruction use a 2-address
format
– Thumb instruction formats are less regular than ARM
instruction formats, as a result of the dense encoding.
SOC Consortium Course Material 27
I/O System
qARM handles input/output peripherals as memory-
mapped with interrupt support
qInternal registers in I/O devices as addressable
locations with ARM’s memory map read and written
using load-store instructions
qInterrupt by normal interrupt (IRQ) or fast interrupt
(FIQ)
qInput signals are level-sensitive and maskable
qMay include Direct Memory Access (DMA)
hardware

SOC Consortium Course Material 28

ARM Core Family

Application Cores Embedded Cores Secure Cores

ARM Cortex-A8 ARM Cortex-M3 SecurCore SC100
ARM1020E ARM1026EJ-S SecurCore SC110
ARM1022E ARM1156T2(F)-S SecurCore SC200
ARM1026EJ-S ARM7EJ-S SecurCore SC210
ARM11 MPCore ARM7TDMI
ARM1136J(F)-S ARM7TDMI-S
ARM1176JZ(F)-S ARM946E-S
ARM720T ARM966E-S
ARM920T ARM968E-S
ARM922T ARM996HS
ARM926EJ-S

SOC Consortium Course Material 29

Product Code Demystified

q T: Thumb
q D: On-chip debug support
q M: Enhanced multiplier
q I: Embedded ICE hardware
q T2: Thumb-2
q S: Synthesizable code
q E: Enhanced DSP instruction set
q J: JAVA support, Jazelle
q Z: Should be TrustZone?
q F: Floating point unit
q H: Handshake, clockless design for synchronous or
asynchronous design

SOC Consortium Course Material 30

ARM Processor Cores (1/4)

q ARM processor core + cache + MMU

→ ARM CPU cores
q ARM6 → ARM7
– 3-stage pipeline
– Keep its instructions and data in the same memory system
– Thumb 16-bit compressed instruction set
– On-chip Debug support, enabling the processor to halt in
response to a debug request
– Enhanced Multiplier, 64-bit result
– Embedded ICE hardware, give on-chip breakpoint and
watchpoint support

SOC Consortium Course Material 31

ARM Processor Cores (2/4)

qARM8 → ARM9
→ ARM10
qARM9
– 5-stage pipeline (130 MHz or 200MHz)
– Using separate instruction and data memory ports
qARM 10 (1998. Oct.)
– High performance, 300 MHz
– Multimedia digital consumer applications
– Optional vector floating-point unit

SOC Consortium Course Material 32

ARM Processor Cores (3/4)
qARM11 (2002 Q4)
• 8-stage pipeline
• Addresses a broad range of applications in the wireless,
consumer, networking and automotive segments
• Support media accelerating extension instructions
• Can achieve 1GHz
• Support AXI
qSecurCore Family
– Smart card and secure IC development

SOC Consortium Course Material 33

ARM Processor Cores (4/4)
qCortex Family
– Provides a large range of solutions optimized around
specific market applications across the full performance
spectrum
– ARM Cortex-A Series, applications processors for
complex OS and user applications.
• Supports the ARM, Thumb and Thumb-2 instruction sets
– ARM Cortex-R Series, embedded processors for real-time
systems.
• Supports the ARM, Thumb, and Thumb-2 instruction sets
– ARM Cortex-M Series, deeply embedded processors
optimized for cost sensitive applications.
• Supports the Thumb-2 instruction set only

SOC Consortium Course Material 34

ARM Architecture Version (1/6)
qVersion 1
– The first ARM processor, developed at Acorn Computers Limited
1983-1985
– 26-bit address, no multiply or coprocessor support
qVersion 2
– Sold in volume in the Acorn Archimedes and A3000 products
– 26-bit addressing, including 32-bit result multiply and
coprocessor
qVersion 2a
– Coprocessor 15 as the system control coprocessor to manage
cache
– Add the atomic load store (SWP) instruction

SOC Consortium Course Material 35

ARM Architecture Version (2/6)
qVersion 3
– First ARM processor designed by ARM Limited (1990)
– ARM6 (macro cell)
ARM60 (stand-alone processor)
ARM600 (an integrated CPU with on-chip cache, MMU, write
buffer)
ARM610 (used in Apple Newton)
– 32-bit addressing, separate CPSR and SPSRs
– Add the undefined and abort modes to allow coprocessor
emulation and virtual memory support in supervisor mode
qVersion 3M
– Introduce the signed and unsigned multiply and multiply-
accumulate instructions that generate the full 64-bit result

SOC Consortium Course Material 36

ARM Architecture Version (3/6)
q Version 4
– Add the signed, unsigned half-word and signed byte load and store
instructions
– Reserve some of SWI space for architecturally defined operation
– System mode is introduced
q Version 4T
– 16-bit Thumb compressed form of the instruction set is introduced
q Version 5T
– Introduced recently, a superset of version 4T adding the BLX, CLZ and
BRK instructions
q Version 5TE
– Add the signal processing instruction set extension

SOC Consortium Course Material 37

ARM Architecture Version (4/6)
qVersion 6
– Media processing extensions (SIMD)
• 2x faster MPEG4 encode/decode
• 2x faster audio DSP

– Improved cache architecture

• Physically addressed caches
• Reduction in cache flush/refill
• Reduced overhead in context switches
– Improved exception and interrupt handling
• Important for improving performance in real-time tasks
– Unaligned and mixed-endian data support
• Simpler data sharing, application porting and saves memory

SOC Consortium Course Material 38

ARM Architecture Version (5/6)

SOC Consortium Course Material 39

ARM Architecture Version (6/6)

Core Architecture
ARM1 v1
ARM2 v2
ARM2as, ARM3 v2a
ARM6, ARM600, ARM610 v3
ARM7, ARM700, ARM710 v3
ARM7TDMI, ARM710T, ARM720T, ARM740T v4T
StrongARM, ARM8, ARM810 v4
ARM9TDMI, ARM920T, ARM940T V4T
ARM9E-S, ARM10TDMI, ARM1020E v5TE
ARM10TDMI, ARM1020E v5TE
ARM11 MPCore, ARM1136J(F)-S, ARM1176JZ(F)-S v6
Cortex-A/R/M v7

SOC Consortium Course Material 40

32-bit Instruction Set

SOC Consortium Course Material 41

ARM Instruction Sets
qARM assembly language program
– ARM development board or ARM emulator
qARM instruction set
– Standard ARM instruction set
– A compressed form of the instruction set, a subset of the
full ARM instruction set is encoded into 16-bit
instructions – Thumb instruction
– Some ARM cores support instruction set extensions to
enhance signal processing capabilities

SOC Consortium Course Material 42

Instructions

qData Processing Instructions

qData Transfer Instructions
qControl Flow Instructions

SOC Consortium Course Material 43

ARM Instruction Set Summary (1/4)

SOC Consortium Course Material 44

ARM Instruction Set Summary (2/4)

SOC Consortium Course Material 45

ARM Instruction Set Summary (3/4)

SOC Consortium Course Material 46

ARM Instruction Set Summary (4/4)

SOC Consortium Course Material 47

ARM Instruction Set Format

SOC Consortium Course Material 48

Data Processing Instruction
qConsist of
– Arithmetic (ADD, SUB, RSB)
– Logical (BIC, AND)
– Compare (CMP, TST)
– Register movement (MOV, MVN)
qAll operands are 32-bit wide; come from registers or
specified as literal in the instruction itself
qSecond operand sent to ALU via barrel shifter
q32-bit result placed in register; long multiply
instruction produces 64-bit result
q3-address instruction format
SOC Consortium Course Material 49
Conditional Execution (1/2)
q Most instruction sets only allow branches to be executed
conditionally.
q However by reusing the condition evaluation hardware, ARM
effectively increase number of instruction
– All instructions contain a condition field which determines whether the
CPU will execute them
– Non-executed instruction still take up 1 cycle
• To allow other stages in the pipeline to complete
q This reduces the number of branches which would stall the
pipeline
– Allows very dense in-line code
– The time penalty of not executing several conditional instructions is
frequently less than overhead of the branch or instruction call that
would otherwise be needed

SOC Consortium Course Material 50

Conditional Execution (2/2)

SOC Consortium Course Material 51

Data Processing Instructions

qSimple Register Operands

qImmediate Operands
qShifted Register Operands
qMultiply

SOC Consortium Course Material 52

Simple Register Operands (1/2)
qArithmetic Operations
ADD r0,r1,r2 ;r0:=r1+r2
ADC r0,r1,r2 ;r0:=r1+r2+C
SUB r0,r1,r2 ;r0:=r1–r2
SBC r0,r1,r2 ;r0:=r1–r2+C–1
RSB r0,r1,r2 ;r0:=r2–r1, reverse subtraction
RSC r0,r1,r2 ;r0:=r2–r1+C–1
– By default data processing operations do no affect the condition flags
qBit-wise Logical Operations
AND r0,r1,r2 ;r0:=r1ANDr2
ORR r0,r1,r2 ;r0:=r1ORr2
EOR r0,r1,r2 ;r0:=r1XORr2
BIC r0,r1,r2 ;r0:=r1AND (NOT r2), bit clear

SOC Consortium Course Material 53

Simple Register Operands (2/2)

qRegister movement operations

– Omit 1st source operand from the format
MOV r0,r2 ;r0:=r2
MVN r0,r2 ;r0:=NOT r2, move 1’s complement

qComparison operations
– Not produce result; omit the destination from the format
– Just set the condition code bits (N, Z, C and V) in CPSR
CMP r1,r2 ;set cc on r1 - r2, compare
CMN r1,r2 ;set cc on r1 + r2, compare negated
TST r1,r2 ;set cc on r1 AND r2, bit test
TEQ r1,r2 ;set cc on r1 XOR r2, test equal

SOC Consortium Course Material 54

Immediate Operands
qReplace the second source operand with an
immediate operand, which is a literal constant,
preceded by “#”
ADD r3,r3,#1 ;r3:=r3+1
AND r8,r7,#&FF ;r8:=r7[7:0], &:hexadecimal

qSince the immediate value is coded within the 32

bits of the instruction, it is not possible to enter
every possible 32-bit value as an immediate.

SOC Consortium Course Material 55

Shift Register Operands
– ADD r3,r2,r1,LSL#3 31 0 31 0
;r3 := r2 + 8 * r1
• A single instruction executed in
a single cycle
00000 00000
q LSL: Logical Shift Left by 0 to LSL #5 LSR #5
31 places, 0 filled at the lsb
31 0 31 0
end 0 1

q LSR, ASL (Arithmetic Shift

Left), ASR, ROR (Rotate 00000 0 11111 1

Right), RRX (Rotate Right , positive operand

ASR #5 ASR #5
, negative operand

eXtended by 1 place) 31 0 31 0
– ADD r5,r5,r3,LSL r2 ; C
r5:=r5+r3*2r2
– MOV r12,r4,ROR r3
C C
;r12:=r4 rotated right by
value of r3 ROR #5 RRX
SOC Consortium Course Material 56
Using the Barrel Shifter: the 2nd Operand

q Register, optionally with shift

operation applied
– Shift value can be either
• 5-bit unsigned integer
• Specified in bottom byte of another
register
– Used for multiplication by constant
q Immediate value
– 8-bit number, with a range of 0 -
255
• Rotated right through even number
of positions
– Allows increased range of 32-bit
constants to be loaded directly into
registers
SOC Consortium Course Material 57
Multiply

qMultiply
MUL r4,r3,r2 ;r4:=(r3*r2)[31:0]

qMultiply-Accumulate
MLA r4,r3,r2,r1 ;r4:=(r3*r2+r1)[31:0]

SOC Consortium Course Material 58

Multiplication by a Constant
qMultiplication by a constant equals to a ((power of 2)
+/- 1) can be done in a single cycle
– Using MOV, ADD or RSBs with an inline shift
qExamples:
– r0 = r1 * 5
– r0 = r1 + (r1 * 4) à ADD r0,r1,r1,LSL #2
qCan combine several instruction to carry out other
multiplies
qExamples:
– r2 = r3 * 119
– r2 = r3 * 17 * 7
– r2 = r3 * (16 + 1) * (8 - 1)
• ADD r2,r3,r3,LSL #4 ;r2:=r3*17
• RSB r2,r2,r2,LSL #3 ;r2:=r2*7
SOC Consortium Course Material 59
Data Processing Instructions (1/3)
q <op>{<cond>}{S} Rd,Rn,#<32-bit immediate>
q <op>{<cond>}{S} Rd,Rn,Rm,{<shift>}
– Omit Rn when the instruction is monadic (MOV, MVN)
– Omit Rd when the instruction is a comparison, producing only
condition code outputs (CMP, CMN, TST, TEQ)
– <shift> specifies the shift type (LSL, LSR, ASL, ASR, ROR or RRX)
and in all cases but RRX, the shift amount which may be a 5-bit
immediate (# < # shift>) or a register Rs
q 3-address format
– 2 source operands and 1 destination register
– One source is always a register, the second may be a register, a
shifted register or an immediate value

SOC Consortium Course Material 60

Data Processing Instructions (2/3)
Opco de Mnemo ni c Meani ng Effect
[2 4 :2 1 ]
0000 AND Logical bit-wise AND Rd := Rn AND Op2
0001 EOR Logical bit-wise exclusive OR Rd := Rn EOR Op2
0010 SUB Subtract Rd := Rn - Op2
0011 RSB Reverse subtract Rd := Op2 - Rn
0100 ADD Add Rd := Rn + Op2
0101 ADC Add with carry Rd := Rn + Op2 + C
0110 SBC Subtract with carry Rd := Rn - Op2 + C - 1
0111 RSC Reverse subtract with carry Rd := Op2 - Rn + C - 1
1000 TST Test Scc on Rn AND Op2
1001 TEQ Test equivalence Scc on Rn EOR Op2
1010 CMP Compare Scc on Rn - Op2
1011 CMN Compare negated Scc on Rn + Op2
1100 ORR Logical bit-wise OR Rd := Rn OR Op2
1101 MOV Move Rd := Op2
1110 BIC Bit clear Rd := Rn AND NOT Op2
1111 MVN Move negated Rd := NOT Op2

SOC Consortium Course Material 61

Data Processing Instructions (3/3)
q Allows direct control of whether or not the condition codes
are affected by S bit (condition code unchanged when S = 0)
– N = 1 if the result is negative; 0 otherwise (i.e. N = bit 31 of the result)
– Z = 1 if the result is zero; 0 otherwise
– C = 1 carry out from the ALU when ADD, ADC, SUB, SBC, RSB,
RSC, CMP, or CMN; carry out from the shifter
– V = 1 if overflow from bit 30 to bit 31; 0 if no overflow
(V is preserved in non-arithmetic operations)
q PC may be used as a source operand (address of the
instruction plus 8) except when a register-specified shift
amount is used
q PC may be specified as the destination register, the
instruction is a form of branch (return from a subroutine)

SOC Consortium Course Material 62

Multiply Instructions (1/2)

q32-bit product (Least Significant)

– MUL{<cond>}{S} Rd,Rm,Rs
– MLA{<cond>}{S} Rd,Rm,Rs,Rn

q64-bit Product
– <mul>{<cond>}{S} RdHi,RdLo,Rm,Rs
– <mul> is UMULL,UMLAC,SMULL,SMLAL

Opco de Mnemo ni c Meani ng Effect

[2 3 :2 1 ]
000 MUL Multiply (32-bit result) Rd := (Rm * Rs) [31:0]
001 MLA Multiply-accumulate (32-bit result) Rd := (Rm * Rs + Rn) [31:0]
100 UMULL Unsigned multiply long RdHi:RdLo := Rm * Rs
101 UMLAL Unsigned multiply-accumulate long RdHi:RdLo += Rm * Rs
110 SMULL Signed multiply long RdHi:RdLo := Rm * Rs
111 SMLAL Signed multiply-accumulate long RdHi:RdLo += Rm * Rs

SOC Consortium Course Material 63

Multiply Instructions (2/2)

qAccumulation is denoted by “+=”

qExample: form a scalar product of two vectors

MOV r11,#20 ;initialize loop counter

MOV r10,#0 ;initialize total
Loop LDR r0,[r8],#4 ;get first component
LDR r1,[r9],#4 ;get second component
MLA r10,r0,r1,r10 ;accumulate product
SUBS r11,r11,#1 ;decrement loop counter
BNE Loop

SOC Consortium Course Material 64

Data Transfer Instructions
qThree basic forms to move data between ARM
registers and memory
– Single register load and store instruction
• A byte, a 16-bit half word, a 32-bit word
– Multiple register load and store instruction
• To save or restore workspace registers for procedure entry and
exit
• To copy clocks of data
– Single register swap instruction
• A value in a register to be exchanged with a value in memory
• To implement semaphores to ensure mutual exclusion on
accesses

SOC Consortium Course Material 65

Single Register Data Transfer

q Word transfer
– LDR / STR
q Byte transfer
– LDRB / STRB
q Halfword transfer
– LDRH / STRH
q Load singled byte or halfword-load value and sign extended
to 32 bits
– LDRSB / LDRSH
q All of these can be conditionally executed by inserting the
appropriate condition code after STR/LDR
– LDREQB

SOC Consortium Course Material 66

Addressing
qRegister-indirect addressing
qBase-plus-offset addressing
– Base register
• r0 – r15
– Offset, and or subtract an unsigned number
• Immediate
• Register (not PC)
• Scaled register (only available for word and unsigned byte
instructions)
qStack addressing
qBlock-copy addressing

SOC Consortium Course Material 67

Register-Indirect Addressing
qUse a value in one register (base register) as a
memory address
LDR r0,[r1] ;r0:=mem32[r1]
STR r0,[r1] ;mem32[r1]:=r0
qOther forms
– Adding immediate or register offsets to the base address

SOC Consortium Course Material 68

Initializing an Address Pointer
qA small offset to the program counter, r15
– ARM assembler has a “pseudo” instruction, ADR
qAs an example, a program which must copy data
from TABLE1 to TABLE2, both of which are near to
the code
Copy ADR r1,TABLE1 ;r1 points to TABLE1
ADR r2,TABLE2 ;r2 points to TABLE2
…
TABLE1
… ;<source>
TABLE2
… ;<destination>

SOC Consortium Course Material 69

Single Register Load and Store

qA base register, and offset which may be another

register or an immediate value
Copy ADR r1,TABLE1
ADR r2,TABLE2
Loop LDR r0,[r1]
STR r0,[r2]
ADD r1,r1,#4
ADD r2,r2,#4
???
…
TABLE1
…
TABLE2
…
SOC Consortium Course Material 70
Base-Plus-Offset Addressing (1/2)

qPre-indexing
LDR r0,[r1,#4] ;r0:=mem32[r1+4]
– Offset up to 4K, added or subtracted, (# -4)
qPost-indexing
LDR r0,[r1],#4 ;r0:=mem32[r1], r1:=r1+4
– Equivalent to a simple register-indirect load, but faster,
less code space
qAuto-indexing
LDR r0, [r1,#4]! ;r0:=mem32[r1+4], r1:=r1+4
– No extra time, auto-indexing performed while the data is
being fetched from memory

SOC Consortium Course Material 71

Base-Plus-Offset Addressing (2/2)

SOC Consortium Course Material 72

Loading Constants (1/2)
q No single ARM instruction can load a 32-bit immediate
constant directly into a register
– All ARM instructions are 32-bit long
– ARM instructions do not use the instruction stream as data
q The data processing instruction format has 12 bits available
for operand 2
– If used directly, this would only give a range of 4096
q Instead it is used to store 8-bit constants, give a range of 0-
255
q These 8 bits can then be rotated right through an even
number of positions
q This gives a much larger range of constants that can be
directly loaded, through some constants will still need to be
loaded from memory

SOC Consortium Course Material 73

Loading Constant (2/2)
qTo load a constant, simply move the required value
into a register – the assembler will convert to the
rotate form for us
– MOV r0,#4096 ;MOV r0,#0x1000 (0x40 ror 26)

qThe bitwise complements can also be formed using

MVN:
– MOV r0,#&FFFFFFFF ;MVN r0,#0

qValue that cannot be generated in this way will

cause an error
SOC Consortium Course Material 74
Loading 32-bit Constants
qTo allow larger constants to be loaded, the
assembler offers a pseudo-instruction:
– LDR Rd,=const
qThis will either:
– Produce a MOV or MVN instruction to generate the value
(if possible) or
– Generate a LDR instruction with a PC-relative address to
read the constant from a literal pool (constant data area
embedded in the code)
qFor example
– MOV r0,=&FF ;MOV r0,#0xFF
– LDR r0,=&55555555 ;LDR r0,[PC,#Imm10]

SOC Consortium Course Material 75

Multiple Register Data Transfer (1/2)
q The load and store multiple instructions (LDM/STM) allow
between 1 and 16 registers to be transferred to or from
memory
– Order of register transfer cannot be specified, order in the list is insignificant
– Lowest register number is always transferred to/form lowest memory location
accessed
q The transferred registers can be either
– Any subset of the current bank of registers (default)
– Any subset of the user mode bank of registers when in a privileged mode
(postfix instruction with a “^”)
q Base register used to determine where memory access
should occur
– 4 different addressing modes
– Base register can be optionally updated following the transfer (using “!”)

SOC Consortium Course Material 76

Multiple Register Data Transfer (2/2)
qThese instruction are very efficient for
– Moving block of data around memory
– Saving and restoring context – stack
qAllow any subset (or all, r0 to r15) of the 16
registers to be transferred with a single instruction

LDMIA r1,{r0,r2,r5} ;r0:=mem32[r1]

;r2:=mem32[r1+4]
;r5:=mem32[r1+8]

SOC Consortium Course Material 77

Stack Processing
q A stack is usually implemented as a linear data structure
which grows up (an ascending stack) or down (a descending
stack) memory
q A stack pointer holds the address of the current top of the
stack, either by pointing to the last valid data item pushed
onto the stack (a full stack), or by pointing to the vacant slot
where the next data item will be placed (an empty stack)
q ARM multiple register transfer instructions support all four
forms of stacks
– Full ascending: grows up; base register points to the highest address
containing a valid item
– empty ascending: grows up; base register points to the first empty location
above the stack
– Full descending: grows down; base register points to the lowest address
containing a valid data
– empty descending: grows down; base register points to the first empty
location below the stack
SOC Consortium Course Material 78
Block Copy Addressing

SOC Consortium Course Material 79

Single Word and Unsigned Byte Data Transfer
instructions
qPre-indexed form
– LDR|STR{<cond>}{B} Rd, [Rn, <offset>]{!}

qPost-indexed form
– LDR|STR{<cond>}{B} Rd, [Rn], <offset>

qPC-relative form
– LDR|STR{<cond>}{B} Rd, LABEL
– LDR: ’load register’; STR: ’store register’
– ‘B’ unsigned byte transfer, default is word;
– <offset> may be # +/-<12-bit immediate> or +/- Rm{, shift}
– !: auto-indexing
– T flag selects the user view of the memory translation and protection
system

SOC Consortium Course Material 80

Example

qStore a byte in r0 to a peripheral

LDR r1, UARTADD ; UART address into r1

STRB r0, [r1] ; store data to UART
UARTADD & &10000000 ; address literal

SOC Consortium Course Material 81

Half-word and Signed Byte Data Transfer
Instructions

qPre-indexed form
– LDR|STR{<cond>}H|SH|SB Rd,[Rn,<offset>]{!}
qPost-indexed form
– LDR|STR{<cond>}H|SH|SB Rd,[Rn],<offset>
– <offset> is # +/-<8-bit immediate> or +/- Rm
– H|SH|SB selects the data type
• Unsigned half-word
• Signed half-word and
• Signed byte
• Otherwise the assumable format is for word and unsigned byte
transfer

SOC Consortium Course Material 82

Example

qExpand an array of signed half-words into an array

of words

ADR r1,ARRAY1 ;half-word array start

ADR r2,ARRAY2 ;word array start
ADR r3,ENDARR1 ;ARRAY1 end + 2
Loop LDRSH r0,[r1],#2;get signed half-word
STR r0,[r2],#4 ;save word
CMP r1,r3 ;check for end of array
BLT Loop ;if not finished, loop

SOC Consortium Course Material 83

Multiple Register Transfer instructions
qLDR|STR{<cond>}{B}<add mode> Rn{!},
<register>
– <add mode> specifies one of the addressing modes
– ‘!’: auto-indexing
– <registers> a list of registers, e.g., {r0, r3-r7, pc}
qIn non-user mode, the CPSR may be restored by
LDM{<cond>}<add mode> Rn{!}, <registers +
PC>^
qIn non-user mode, the user registers may be saved
or restored by
LDM|STM{<cond>}<add mode> Rn, <registers -
PC>^
– The register list must not contain PC and write-back is no allowed
SOC Consortium Course Material 84
Example

qSave 3 work registers and the return address upon

entering a subroutine (assume r13 has been
initialized for use as a stack pointer)
STMFD r13!,{r0-r2,r14}

qRestore the work registers and return

LDMFD r13!,{r0-r2,PC}

SOC Consortium Course Material 85

Swap Memory and Register Instructions

q SWP{<cond>}{B} Rd,Rm,[Rn]
q Rd <- [Rn], [Rn] <- Rm

qCombine a load and a store of a word or an

unsigned byte in a single instruction
qExample
ADR r0,SEMAPHORE
SWPB r1,r1,[r0] ;exchange byte

SOC Consortium Course Material 86

Status Register to General Register Transfer
Instructions
q MRS{<cond>} Rd,CPSR|SPSR

qThe CPSR or the current mode SPSR is copied into

the destination register. All 32 bits are copied.

qExample
MRS r0,CPSR
MRS r3,SPSR

SOC Consortium Course Material 87

General Register to Status Register Transfer
Instructions
q MSR{<cond>} CPSR_<field>|SPSR_<field>,#<32-
bit immediate>
MSR{<cond>} CPSR_<field>|SPSR_<field>,Rm
– <field> is one of
• c – the control field PSR[7:0]
• x – the extension field PSR[15:8]
• s – the status field PSR[23:16]
• f – the flag field PSR[31:24]
qExample
– Set N, X, C, V flags
• MSR CPSR_f,#&f0000000

SOC Consortium Course Material 88

Control Flow Instructions

qBranch Instructions
qConditional Branches
qConditional Execution
qBranch and Link Instructions
qSubroutine Return Instructions
qSupervisor Calls
qJump Tables

SOC Consortium Course Material 89

Branch Instructions
B LABEL
…
LABEL …

– LABEL comes after or before the branch instruction

SOC Consortium Course Material 90

Conditional Branches

qThe branch has a condition associated with it and it

is only executed if the condition codes have the
correct value – taken or not taken

MOV r0,#0 ;initialize counter

Loop …
ADD r0,r0,#1 ;increment loop counter
CMP r0,#10 ;compare with limit
BNE Loop ;repeat if not equal
;else fail through

SOC Consortium Course Material 91

Conditional Branch

SOC Consortium Course Material 92

Conditional Execution
q An unusual feature of the ARM instruction set is that
conditional execution applies no only to branches but to all
ARM instructions
CMP r0,#5 CMP r0,#5
BEQ Bypass ;if (r0!=5) ADDNE r1,r1,r0
ADD r1,r1,r0 ;{r1=r1+r0} SUBNE r1,r1,r2
SUB r1,r1,r2
Bypass …

q Whenever the conditional sequence is 3 instructions for

fewer it is better (smaller and faster) to exploit conditional
execution than to use a branch
CMP r0,r1
if((a==b)&&(c==d)) e++;
CMPEQ r2,r3
ADDEQ r4,r4,#1
SOC Consortium Course Material 93
Branch and Link Instructions
q Perform a branch, save the address following the branch in
the link register, r14
BL SUBR ;branch to SUBR
… ;return here
SUBR … ;subroutine entry point
MOV PC,r14 ;return
q For nested subroutine, push r14 and some work registers
required to be saved onto a stack in memory
BL SUB1
…
SUB1 STMFD r13!,{r0-r2,r14};save work and link regs
…
SUB2 …

SOC Consortium Course Material 94

Subroutine Return Instructions
SUB …
MOV PC,r14 ;copy r14 into r15 to return

qWhere the return address has been pushed onto a

stack
SUB1 STMFD r13!,{r0-r2,r14} ;save work regs and link
BL SUB2
…
LDMFD r13!,{r0-r2,PC} ;restore work regs &
;return

SOC Consortium Course Material 95

Branch and Branch with Link (B,BL)
q B {L} {<cond>} <target address>
– <target address> is normally a label in the assembler code.

24-bit offset, sign-extended, shift left 2 places

+ PC (address of branch instruction + 8)
target address

SOC Consortium Course Material 96

Examples
qUnconditional jump qConditional subroutine
B LABEL call
… CMP r0,#5
LABEL … BLLT SUB1 ;if r0<5,
qLoop ten times ;call sub1
MOV r0,#10 BLGE SUB2 ;else call
Loop … ;SUB2
SUBS r0,#1
BNE Loop
…

qCall a subroutine
BL SUB
…
SUB…
MOV PC,r14
SOC Consortium Course Material 97
Branch, Branch with Link and eXchange
q B{L}X{<cond>} Rm
– The branch target is specified in a register, Rm
– Bit[0] of Rm is copied into the T bit in CPSR; bit[31:1] is moved into
PC
– If Rm[0] is 1, the processor switches to execute Thumb instructions
and begins executing at the address in Rm aligned to a half-word
boundary by clearing the bottom bit
– If Rm[0] is 0, the processor continues executing ARM instructions and
begins executing at the address in Rm aligned to a word boundary by
clearing Rm[1]
q BLX <target address>
– Call Thumb subroutine from ARM
– The H bit (bit 24) is also added into bit 1 of the resulting addressing,
allowing an odd half-word address to be selected for the target
instruction which will always be a Thumb instruction

SOC Consortium Course Material 98

Example

qA call to a Thumb subroutine

CODE32
…
BLX TSUB ;call Thumb subroutine
…
CODE16 ;start of Thumb code
TSUB …
BX r14 ;return to ARM code

SOC Consortium Course Material 99

Supervisor Calls
qThe supervisor is a program which operates at a
privileged level, which means that it can do things
that a use-level program cannot do directly (e.g.
input or output)
qSWI instruction
– Software interrupt or supervisor call

SWI SWI_WriteC ;output r0[7:0]

SWI SWI_Exit ;return to monitor program

SOC Consortium Course Material 100

Software Interrupt (SWI)
q SWI{<cond>}<24-bit immediate>
– Used for calls to the operating system and is often called
a “supervisor call”
– It puts the processor into supervisor mode and begins
executing instruction from address 0x08
• Save the address of the instruction after SWI in r14_svc
• Save the CPSR in SPSR_svc
• Enter supervisor mode and disable IRQs by setting CPSR[4:0] to
100112 and CPSR[7] to 1
• Set PC to 0816 and begin executing the instruction there
– The 24-bit immediate does not influence the operation of
the instruction but may be interpreted by the system code

SOC Consortium Course Material 101

Examples
q Output the character ‘A’
MOV r0,#’A’
SWI SWI_WriteC
q Finish executing the user program and return to the monitor
SWI SWI_EXIT
q A subroutine to output a text string
BL STROUT
= “Hello World”, &0a, &0d,0
…
STROUT LDRB r0,[r14], #1 ;get character
CMP r0,#0 ;check for end marker
SWINE SWI_WriteC if not end, print
BNE STROUT ; … ,loop
ADD r14,#3 ;align to next word
BIC r14,#3
MOV PC,r14 ;return
SOC Consortium Course Material 102
16-bit Instruction Set

SOC Consortium Course Material 103

Thumb Instruction Set (1/3)

SOC Consortium Course Material 104

Thumb Instruction Set (2/3)

SOC Consortium Course Material 105

Thumb Instruction Set (3/3)

SOC Consortium Course Material 106

Thumb Instruction Format

SOC Consortium Course Material 107

Register Access in Thumb
qNot all registers are directly accessible in Thumb
qLow register r0 – r7: fully accessible
qHigh register r8 – r12: only accessible with MOV,
ADD, CMP; only CMP sets the condition code flags
qSP (Stack Pointer), LR (Link Register) & PC
(Program Counter): limited accessibility, certain
instructions have implicit access to these
qCPSR: only indirect access
qSPSR: no access

SOC Consortium Course Material 108

Thumb-ARM Difference
q Thumb instruction set is a subset of the ARM instruction set
and the instructions operate on a restricted view of the ARM
registers
q Most Thumb instructions are executed unconditionally (All
ARM instructions are executed conditionally)
q Many Thumb data processing instructions use two 2-address
format, i.e., the destination register is the same as one of the
source registers (ARM data processing instructions, with the
exception of the 64-bit multiplies, use a 3-address format)
q Thumb instruction formats are less regular than ARM
instruction formats => dense encoding

SOC Consortium Course Material 109

Thumb Accessible Registers

Shaded registers have

restricted access

SOC Consortium Course Material 110

Branches
q Thumb defines three PC-relative branch instructions, each of
which have different offset ranges
– Offset depends upon the number of available bits
q Conditional branches
– B<cond> label
– 8-bit offset: range of -128 to 127 instruction (+/-256 bytes)
– Only conditional Thumb instructions
q Unconditional branches
– B label
– 11-bit offset: range of -1024 to 1023 instructions (+/-2Kbytes)
q Long branches with link
– BL subroutine
– Implemented as a pair of instructions
– 22-bit offset: range of -2097152 to 2097151 instruction (+/-4Mbytes)
SOC Consortium Course Material 111
Data Processing Instruction
qSubset of the ARM data processing instructions
qSeparate shift instructions (e.g. LSL, ASR, LSR,
ROR)
LSL Rd,Rs,#Imm5 ;Rd:=Rs <shift> #Imm5
ASR Rd,Rs ;Rd:=Rd <shift> Rs

qTwo operands for data processing instructions

– Act on low registers
BIC Rd,Rs ;Rd:=Rd AND NOT Rs
ADD Rd,#Imm8 ;Rd:=Rd+#Imm8
– Also three operand forms of add, subtract and shifts
ADD Rd,Rs,#Imm3 ;Rd:=Rs+#Imm3

qCondition code always set by low register

operations
SOC Consortium Course Material 112
Load or Store Register
q Two pre-indexed addressing modes
– Base register + offset register
– Base register + 5-bit offset, where offset scaled by
• 4 for word accesses (range of 0-124 bytes / 0-31 words)
– STR Rd,[Rd,#Imm7]
• 2 for halfword accesses (range of 0-62 bytes / 0-31 halfwords)
– LDRH Rd,[Rb,#Imm6]
• 1 for bytes accesses (range of 0-31 bytes)
– LDRB Rd,[Rb,#Imm5]

q Special forms:
– Load with PC as base with 1K-byte immediate offset (word aligned)
• Used for loading a value from a literal pool
– Load and store with SP as base with 1K-byte immediate offset (word
aligned)
• Used for accessing local variables on the stack

SOC Consortium Course Material 113

Block Data Transfers
qMemory copy, incrementing base pointer after
transfer
– STMIA Rb!, {Low Reg list}
– LDMIA Rb!, {Low Reg list}
qFull descending stack operations
– PUSH {Low Reg list}
– PUSH {Low Reg List, LR}
– POP {Low Reg list}
– POP {Low Reg List, PC}
qThe optional addition of the LR/PC provides support
for subroutine entry/exit

SOC Consortium Course Material 114

Thumb Instruction Entry and Exit
q T bit, bit 5 of CPSR
– If T = 1, the processor interprets the instruction stream as 16-bit
Thumb instruction
– If T = 0, the processor interprets if as standard ARM instructions
q Thumb Entry
– ARM cores startup, after reset, execution ARM instructions
– Executing a branch and Exchange instruction (BX)
• Set the T bit if the bottom bit of the specified register was set
• Switch the PC to the address given in the remainder of the register
q Thumb Exit
– Executing a thumb BX instruction

SOC Consortium Course Material 115

The Need for Interworking
q The code density of Thumb and its performance from narrow
memory make it ideal for the bulk of C code in many systems.
However there is still a need to change between ARM and
Thumb state within most applications:
– ARM code provides better performance from wide memory
• Therefore ideal for speed-critical parts of an application
– Some functions can only be performed with ARM instructions,
e.g.
• Access to CPSR (to enable/disable interrupts & to change mode)
• Access to coprocessors
– Exception Handling
• ARM state is automatically entered for exception handling, but system
specification may require usage of Thumb code for main handler
– Simple standalone Thumb programs will also need an ARM
assembler header to change state and call the Thumb routine
SOC Consortium Course Material 116
Interworking Instructions
qInterworking is achieved using the Branch
Exchange instructions
– In Thumb state
BX Rn
– In ARM state (on Thumb-aware cores only)
BX<condition> Rn
Where Rn can be any registers (R0 to R15)
qThe ARM performs a branch to an absolute address
in 4GB address space by copying Rn to the
program counter
qBit 0 of Rn specifies the state to change to

SOC Consortium Course Material 117

Switching between States

SOC Consortium Course Material 118

Example
;start off in ARM state
CODE32
ADR r0,Into_Thumb+1 ;generate branch target
;address & set bit 0
;hence arrive Thumb state
BX r0 ;branch exchange to Thumb
…
CODE16 ;assemble subsequent as Thumb
Into_Thumb …
ADR r5,Back_to_ARM ;generate branch target to
;word-aligned address,
;hence bit 0 is cleared.
BX r5 ;branch exchange to ARM
…
CODE32 ;assemble subsequent as ARM
Back_to_ARM …
SOC Consortium Course Material 119
Summary

qARM Architecture
– Load/Store Architecture
– 32-bit Instructions
– 3-address Instruction Formats
– 37 Registers
qInstruction Set
– 32-bit ARM Instruction
– 16-bit Thumb Instruction
qARM/Thumb Interworking

SOC Consortium Course Material 120

References
[1] http://twins.ee.nctu.edu.tw/courses/ip_core_02/index.html
[2] ARM System-on-Chip Architecture by S.Furber, Addison
Wesley Longman: ISBN 0-201-67519-6.
[3] www.arm.com

SOC Consortium Course Material 121