The ARM Instruction Set - University of Texas at Austin

1 EE382N-4 Embedded Systems ArchitectureThe ARM Instruction Set ArchitectureMark McDermottWith help from our good friends at ARMFall 20088/22/2008EE382N-4 Embedded Systems ArchitectureMain features of the ARM Instruction Set All instructions are 32 bits long. Most instructions execute in a single cycle. Most instructions can be conditionally executed. A load/store architecture Data processing instructions act only on registers Three operand format Combined ALU and shifter for high speed bit manipulation Specific memory access instructions with powerful auto indexing addressing modes. 32 bit and 8 bit data types and also 16 bit data types on ARM Architecture v4. Flexible multiple register load and store instructions Instruction set extension via coprocessors Very dense 16 bit compressed Instruction set (Thumb)28/22/2008EE382N-4 Embedded Systems ArchitectureCoprocessors3 Up to 16coprocessors can be defined Expands the ARM Instruction set Each coprocessor can have up to 16 private registers of any reasonable size Load store architectureEE382N-4 Embedded Systems ArchitectureThumb Thumb is a 16 bit Instruction set Optimized for code density from C code Improved performance form narrow memory Subset of the functionality of the ARM Instruction set Core has two execution states ARM and Thumb Switch between them using BX Instruction Thumb has characteristic features.

2 Most Thumb Instruction are executed unconditionally Many Thumb data process Instruction use a 2 address format Thumb Instruction formats are less regular than ARM Instruction formats, as a result of the dense Embedded Systems ArchitectureProcessor Modes The ARM has six operating modes: User (unprivileged mode under which most tasks run) FIQ (entered when a high priority (fast) interrupt is raised) IRQ (entered when a low priority (normal) interrupt is raised) Supervisor (entered on reset and when a Software Interrupt Instruction is executed) Abort (used to handle memory access violations) Undef (used to handle undefined instructions) ARM Architecture Version 4 adds a seventh mode: System (privileged mode using the same registers as user mode)58/22/2008EE382N-4 Embedded Systems ArchitectureThe Registers ARM has 37 registers in total, all of which are 32 bits long. 1 dedicated program counter 1 dedicated current program status register 5 dedicated saved program status registers 30 general purpose registers However these are arranged into several banks, with the accessible bank being governed by the processor mode.

3 Each mode can access a particular set of r0 r12 registers a particular r13 (the stack pointer) and r14 (link register) r15 (the program counter ) cpsr (the current program status register) And privileged modes can also access a particular spsr (saved program status register)68/22/2008EE382N-4 Embedded Systems Architecturer0r1r2r3r4r5r6r7r8r9r10r11r1 2r13 (sp)r14 (lr)r15 (pc)cpsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr8r9r10r11r12r13 (sp)r14 (lr)spsrFIQIRQSVCU ndefAbortUser Moder0r1r2r3r4r5r6r7r8r9r10r11r12r13 (sp)r14 (lr)r15 (pc)cpsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr8r9r10r11r12r13 (sp)r14 (lr)spsrCurrent Visible RegistersBanked out RegistersFIQIRQSVCU ndefAbortr0r1r2r3r4r5r6r7r15 (pc)cpsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr8r9r10r11r12r13 (sp)r14 (lr)spsrCurrent Visible RegistersBanked out RegistersUserIRQSVCU ndefAbortr8r9r10r11r12r13 (sp)r14 (lr)FIQ ModeIRQ Moder0r1r2r3r4r5r6r7r8r9r10r11r12r15 (pc)cpsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr8r9r10r11r12r13 (sp)r14 (lr)spsrCurrent Visible RegistersBanked out RegistersUserFIQSVCU ndefAbortr13 (sp)r14 (lr)Undef Moder0r1r2r3r4r5r6r7r8r9r10r11r12r15 (pc)cpsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr8r9r10r11r12r13 (sp)r14 (lr)spsrCurrent Visible RegistersBanked out RegistersUserFIQIRQSVCA bortr13 (sp)r14 (lr)SVC Moder0r1r2r3r4r5r6r7r8r9r10r11r12r15 (pc)cpsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr8r9r10r11r12r13 (sp)r14 (lr)spsrCurrent Visible RegistersBanked out RegistersUserFIQIRQU ndefAbortr13 (sp)r14 (lr)Abort Moder0r1r2r3r4r5r6r7r8r9r10r11r12r15 (pc)cpsrr13 (sp)r14 (lr)spsrr13 (sp)

4 R14 (lr)spsrr13 (sp)r14 (lr)spsrr13 (sp)r14 (lr)spsrr8r9r10r11r12r13 (sp)r14 (lr)spsrCurrent Visible RegistersBanked out RegistersUserFIQIRQSVCU ndefr13 (sp)r14 (lr)The ARM Register Set78/22/2008EE382N-4 Embedded Systems ArchitectureRegister Organization Summary88/22/2008 Usermoder0-r7,r15,andcpsrr8r9r10r11r12r1 3 (sp)r14 (lr)spsrFIQr8r9r10r11r12r13 (sp)r14 (lr)r15 (pc)cpsrr0r1r2r3r4r5r6r7 Userr13 (sp)r14 (lr)spsrIRQU sermoder0-r12,r15,andcpsrr13 (sp)r14 (lr)spsrUndefUsermoder0-r12,r15,andcpsrr 13 (sp)r14 (lr)spsrSVCU sermoder0-r12,r15,andcpsrr13 (sp)r14 (lr)spsrAbortUsermoder0-r12,r15,andcpsrT humb stateLow registersThumb stateHigh registersNote: System mode uses the User mode register set EE382N-4 Embedded Systems ArchitectureAccessing Registers using ARM Instructions No breakdown of currently accessible registers. All instructions can access r0 r14 directly. Most instructions also allow use of the PC. Specific instructions to allow access to CPSR and SPSR.

5 Note : When in a privileged mode, it is also possible to load store the (banked out) user mode registers to or from memory. 98/22/2008EE382N-4 Embedded Systems ArchitectureThe Program Status Registers (CPSR and SPSRs)108/22/2008 Copies of the ALU status flags (latched if theinstruction has the "S" bit set).N = Negative result from ALU = Zero result from ALU = ALU operation Carried outV = ALU operation oVerflowed* Interrupt Disable 1, disables the 1, disables the FIQ.* T Bit (Architecture v4T only)T = 0, Processor in ARM stateT = 1, Processor in Thumb state * Condition Code FlagsModeNZCV2831840I F T* Mode BitsM[4:0] define the processor Embedded Systems ArchitectureLogical InstructionArithmetic InstructionFlagNegativeNo meaningBit 31 of the result has been set(N= 1 )Indicates a negative number insigned operationsZeroResult is all zeroesResult of operation was zero(Z= 1 )CarryAfter Shift operationResult was greater than 32 bits(C= 1 ) 1 was left in carry flagoVerflowNo meaningResult was greater than 31 bits(V= 1 )Indicates a possible corruption ofthe sign bit in signed numbersCondition Flags118/22/2008EE382N-4 Embedded Systems ArchitectureThe Program counter (R15) When the processor is executing in ARM state: All instructions are 32 bits in length All instructions must be word aligned Therefore the PC value is stored in bits [31:2] with bits [1.]

6 0] equal to zero (as Instruction cannot be halfword or byte aligned). R14 is used as the subroutine link register (LR) and stores the return address when Branch with Link operations are performed, calculated from the PC. Thus to return from a linked branch:MOV r15,r14orMOV pc,lr128/22/2008EE382N-4 Embedded Systems ArchitectureException Handling and the Vector Table When an exception occurs, the core: Copies CPSR into SPSR_<mode> Sets appropriate CPSR bits If core implements ARM Architecture 4T and is currently in Thumb state, then ARM state is entered. Mode field bits Interrupt disable flags if appropriate. Maps in appropriate banked registers Stores the return address in LR_<mode> Sets PC to vector address To return, exception handler needs to: Restore CPSR from SPSR_<mode> Restore PC from LR_<mode>138/22/2008EE382N-4 Embedded Systems ArchitectureThe Original Instruction Pipeline The ARM uses a pipeline in order to increase the speed of the flow of instructions to the processor.

7 Allows several operations to be undertaken simultaneously, rather than serially. Rather than pointing to the Instruction being executed, the PC points to the Instruction being fetched from memoryDecoding of registers used in instructionRegister(s) read from Register BankShift and ALU operationWrite register(s) back to Register BankPCPC - 4PC - 8EE382N-4 Embedded Systems ArchitecturePipeline changes for ARM9 TDMII nstructionFetchShift + ALUM emoryAccessRegWriteRegReadRegDecodeFETCH DECODEEXECUTEMEMORYWRITEARM9 TDMIARM or ThumbInst DecodeReg SelectRegReadShiftALURegWriteThumb ARMdecompressARM decodeInstructionFetchFETCHDECODEEXECUTE ARM7 TDMIEE382N-4 Embedded Systems ArchitecturePipeline changes for ARM10 vs. ARM11 PipelinesARM11 Fetch1 Fetch2 DecodeIssueShiftALUS aturateWritebackMAC1 MAC2 MAC3 AddressDataCache1 DataCache2 Shift + ALUM emoryAccessRegWriteFETCHDECODEEXECUTEMEM ORYWRITEReg Read MultiplyBranchPredictionInstructionFetch ISSUEARM or ThumbInstructionDecodeMultiply AddARM10EE382N-4 Embedded Systems ArchitectureARM Instruction Set Format178/22/200831302928272625242322212 0191817161514131211109876543210 Instruction TypeCondition0 0 IOPCODESRnRsOPERAND 2 Data processingCondition0 0 0 0 0 0 A SRdRnRs1 0 0 1 RmMultiplyCondition00001 UASRd HIGHRd LOWRs1 0 0 1 RmLong MultiplyCondition00010B00 RnRd00001001 RmSwapCondition0 1 I P U B W LRnRdOFFSETLoad/Store Byte/WordCondition100 PUBWLRnREGISTER LISTLoad/Store MultipleCondition0 0 0 P U 1 W LRnRdOFFSET 11 S H 1 OFFSET 2 Halfword Transfer Imm OffCondition000PU0 WLRnRd00001SH1 RmHalfwordTransfer Reg OffCondition1 0 1 LBRANCH OFFSETB

8 RanchCondition000100101111111111110001 RnBranchExchangeCondition1 1 0 P U N W LRnCRdCPNumOFFSETCOPROCESSOR DATA XFERC ondition1110Op 1 CRnCRdCPNumOP 20 CRmCOPROCESSOR DATA OPConditionOP 1 LCRnRdCPNumOP 21 CRmCOPROCESSOR REG XFERC ondition1111 SWINUMBERS oftware InterruptEE382N-4 Embedded Systems ArchitectureConditional Execution Most Instruction sets only allow branches to be executed conditionally. However by reusing the condition evaluation hardware, ARM effectively increases number of instructions. All instructions contain a condition field which determines whether the CPU will execute them. Non executed instructions consume 1 cycle. Can t collapse the Instruction like a NOP. Still have to complete cycle so as to allow fetching and decoding of the following instructions. This removes the need for many branches, which stall the pipeline (3 cycles to refill). Allows very dense in line code, without branches.

9 The Time penalty of not executing several conditional instructions is frequently less than overhead of the branch or subroutine call that would otherwise be Embedded Systems ArchitectureThe Condition Field198/22/20081001 = LS - C clear or Z (set unsigned lower or same) 1010 = GE - N set and V set, or N clear and V clear (>or =)1011 = LT - N set and V clear, or N clear and V set (>)1100 = GT - Z clear, and either N set and V set, or N clear and V set (>)1101 = LE - Z set, or N set and V clear,or N clear and V set (<, or =)1110 = AL - always1111 = NV - = EQ - Z set (equal)0001 = NE - Z clear (not equal)0010 = HS / CS - C set (unsigned higher or same)0011 = LO / CC - C clear (unsigned lower)0100 = MI -N set (negative)0101 = PL - N clear (positive or zero)0110 = VS - V set (overflow)0111 = VC - V clear (no overflow)1000 = HI - C set and Z clear (unsigned higher)313029282726252423222120191817161 514131211109876543210 Instruction TypeCondition0 0 IOPCODESRnRsOPERAND 2 Data processingEE382N-4 Embedded Systems ArchitectureUsing and updating the Condition Field To execute an Instruction conditionally, simply postfix it with the appropriate condition: For example an add Instruction takes the form: ADD r0,r1,r2 ; r0 = r1 + r2 (ADDAL) To execute this only if the zero flag is set: ADDEQ r0,r1,r2; If zero flag set.

10 R0 = r1 + r2 By default, data processing operations do not affect the condition flags (apart from the comparisons where this is the only effect). To cause the condition flags to be updated, the S bit of the Instruction needs to be set by postfixing the Instruction (and any condition code) with an S . For example to add two numbers and set the condition flags: ADDS r0,r1,r2; r0 = r1 + r2 ; .. and set flags208/22/2008EE382N-4 Embedded Systems ArchitectureConditional Execution and Flags ARM instructions can be made to execute conditionally by postfixing them with the appropriate condition code field. This improves code density andperformance by reducing the number of forward branch r3,#0 CMP r3,#0 BEQ skip ADDNE r0,r1,r2 ADD r0,r1,r2skip By default, data processing instructions do not affect the condition code flags but the flags can be optionally set by using S.