Module 5

Introduction to the ARM Instruction Set

Topics

□ Data Processing Instructions

□ Branch Instructions
□ Software Interrupt Instructions
□ Program Status Register Instructions
□ Coprocessor Instructions
□ Loading Constants

AIEMS BIDADI 1 DR.PDT

 Introduction

▪ Processor operations is illustrated using examples with pre- and

post-conditions, describing registers and memory before and after the
instruction or instructions are executed.
▪ The examples follow this format:
PRE <pre-conditions>
<instruction/s>
POST <post-conditions>

AIEMS BIDADI 2 DR.PDT

▪ In the pre- and post-conditions, memory is denoted as
– mem<data_size>[address]
This refers to data_size bits of memory starting at the given byte
address.
▪ For example,
mem32[1024] is the 32-bit value starting at address 1 KB.

AIEMS BIDADI 3 DR.PDT

▪ ARM instructions process data held in registers and only access
memory with load and store instructions.
▪ ARM instructions commonly take two or three operands.
▪ For instance the ADD instruction below adds the two values stored in
registers r1 and r2 (the source registers).
▪ It writes the result to register r3 (the destination register).

Instruction Destination Source Source

Syntax register (Rd) register 1 (Rn) register 2 (Rm)

ADD r3, r1, r2 r3 r1 r2

AIEMS BIDADI 4 DR.PDT

 DATA PROCESSING INSTRUCTIONS

▪ manipulates data within registers

- move instructions
- arithmetic instructions
- logical instructions
- comparison instructions

- multiply instructions
▪ Most data processing instructions can process one of their operands
using the barrel shifter.

AIEMS BIDADI 5 DR.PDT

▪ If you use the S suffix on a data processing instruction, then it updates
the flags in the cpsr.
▪ Move and logical operations update the carry flag C, negative flag N,
and zero flag Z.
▪ The carry flag is set from the result of the barrel shift as the last bit
shifted out.
▪ The N flag is set to bit 31 of the result.
▪ The Z flag is set if the result is zero.

AIEMS BIDADI 6 DR.PDT

MOVE INSTRUCTIONS

▪ simplest ARM instruction

▪ copies N into a destination register Rd, where
N is a register or immediate value
▪ useful for setting initial values and transferring data between registers
▪ Syntax:
<instruction> {<cond>} {S} Rd, N

MOV Move a 32-bit value into a register Rd = N

AIEMS BIDADI 7 DR.PDT

 Move the NOT of the 32-bit value into a
MVN Rd = ∼N
Register

AIEMS BIDADI 8 DR.PDT

▪ EXAMPLE: The MOV instruction takes the contents of register r5 and
copies them into register r7, in this case, taking the value 5, and
overwriting the value 8 in register r7.

PRE r5=5
r7=8
MOV r7, r5 ; let r7 = r5
POST r5=5
r7=5

AIEMS BIDADI 9 DR.PDT

BARREL SHIFTER
▪ In the MOV instruction N can be more than just a register or
immediate value
▪ It can also be a register Rm that has been preprocessed by the barrel
shifter prior to being used by a data processing instruction.
▪ Data processing instructions are processed within the arithmetic logic
unit (ALU).
▪ A unique and powerful feature of the ARM processor is the ability to
shift the 32-bit binary pattern in one of the source registers left or right
by a specific number of positions before it enters the ALU.
▪ This shift increases the power and flexibility of many data processing

AIEMS BIDADI 10 DR.PDT

operations.

AIEMS BIDADI 11 DR.PDT

▪ There are data processing instructions that do not use the barrel shift,
▪ for example
- MUL (multiply)
- CLZ (count leading zeros)

- QADD (signed saturated 32-bit add) instructions.

▪ Pre-processing or shift occurs within the cycle time of the instruction.
▪ This is particularly useful for loading constants into a register and
achieving fast multiplies or division by a power of 2

AIEMS BIDADI 12 DR.PDT

▪ Fig shows the data flow between the ALU
and the barrel shifter.
▪ add a shift operation to the move
instruction
▪ Register Rn enters the ALU without any
pre- processing of registers
▪ We apply a logical shift left (LSL) to
register Rm before moving it to the
destination register
▪ The MOV instruction copies the shift Figure : Barrel shifter and ALU.
operator result N into register Rd.
▪ N represents the result of the LSL
operation
AIEMS BIDADI 13 DR.PDT
▪ The five different shift operations that you can use within the barrel
shifter are summarized in Table below

AIEMS BIDADI 14 DR.PDT

AIEMS BIDADI 15 DR.PDT
▪ Figure below illustrates a logical shift left by one.

• The contents of bit 0 are shifted to bit 1.

• Bit 0 is cleared.
• The C flag is updated with the last bit shifted out of the register.
• This is bit (32 y) of the original value, where y is the shift amount. When y is
greater than one, then a shift by y positions is the same as a shift by one
AIEMS BIDADI 16 DR.PDT
position executed y times.

AIEMS BIDADI 17 DR.PDT

PRE r5=5
r7=8

MOV r7, r5, LSL #2 ; let r7 = r5*4 = (r5 << 2)

POST r5=5
r7 = 20

AIEMS BIDADI 18 DR.PDT

AIEMS BIDADI 19 DR.PDT
AIEMS BIDADI 20 DR.PDT
AIEMS BIDADI 21 DR.PDT
AIEMS BIDADI 22 DR.PDT
AIEMS BIDADI 23 DR.PDT
ARITHMETIC INSTRUCTIONS
▪ implement addition and subtraction of 32-bit signed and unsigned
values.
▪ Syntax:
<instruction>{<cond>}{S} Rd, Rn, N

AIEMS BIDADI 24 DR.PDT

AIEMS BIDADI 25 DR.PDT
AIEMS BIDADI 26 DR.PDT
AIEMS BIDADI 27 DR.PDT
USING THE BARREL SHIFTER WITH ARITHMETIC INSTRUCTIONS

AIEMS BIDADI 28 DR.PDT

LOGICAL INSTRUCTIONS

▪ performs bitwise logical operations on the two source registers.

▪ Syntax:
<instruction>{<cond>}{S} Rd, Rn, N

AIEMS BIDADI 29 DR.PDT

AIEMS BIDADI 30 DR.PDT
▪ BIC instruction is particularly useful when clearing status bits and is
frequently used to change interrupt masks in the cpsr.
▪ The logical instructions update the cpsr flags only if the S suffix is
present.
▪ These instructions can use barrel-shifted second operands in the
same way as the arithmetic instructions.

AIEMS BIDADI 31 DR.PDT

COMPARISON INSTRUCTIONS

▪ used to compare or test a register with a 32-bit value

▪ update the cpsr flag bits according to the result, but do not affect other
registers

▪ After the bits have been set, the information can then be used to
change program flow by using conditional execution.

▪ Syntax:
<instruction> {<cond>} Rn, N

AIEMS BIDADI 32 DR.PDT

 CMN compare negated flags set as a result of Rn + N
CMP compare flags set as a result of Rn − N
TEQ test for equality of two 32-bit flags set as a result of Rn ∧
N
values
TST test bits of a 32-bit value flags set as a result of Rn & N

▪ N is the result of the shifter operation

AIEMS BIDADI 33 DR.PDT

AIEMS BIDADI 34 DR.PDT
MULTIPLY INSTRUCTIONS
▪ multiply the contents of a pair of registers and, depending upon the
instruction, accumulate the results in with another register
▪ The long multiplies accumulate onto a pair of registers representing a
64-bit value
▪ The final result is placed in a destination register or a pair of registers.
▪ Syntax:
MLA{<cond>}{S} Rd, Rm, Rs, Rn
MUL{<cond>}{S} Rd, Rm, Rs

MLA multiply and accumulate Rd = (Rm∗Rs) + Rn

AIEMS BIDADI 35 DR.PDT

 MUL multiply Rd = Rm∗Rs

AIEMS BIDADI 36 DR.PDT

 ▪ Syntax: <instruction>{<cond>}{S} RdLo, RdHi, Rm, Rs

SMLAL signed multiply [RdHi, RdLo]= [RdHi, RdLo]+ (Rm ∗Rs)

accumulate long

SMULL signed multiply long [RdHi, RdLo]= Rm ∗Rs

unsigned multiply
UMLAL accumulate long [RdHi, RdLo]= [RdHi, RdLo]+ (Rm ∗Rs)

UMULL unsigned multiply long [RdHi, RdLo]= Rm ∗Rs

▪ The long multiply instructions (SMLAL, SMULL, UMLAL, and UMULL)

produce a 64-bit result.
▪ The result is too large to fit a single 32-bit register so the result is placed
in two registers labeled RdLo and RdHi.
▪ RdLo holds the lower 32 bits of the 64-bit result, and RdHi holds the
AIEMS BIDADI 37 DR.PDT
higher 32 bits of the 64-bit result.

AIEMS BIDADI 38 DR.PDT

AIEMS BIDADI 39 DR.PDT
BRANCH INSTRUCTIONS
▪ changes the flow of execution or is used to call a routine
▪ allows programs to have subroutines, if-then-else structures, and loops
▪ The change of execution flow forces the program counter pc to point to a new
address

▪ Syntax:
B{<cond>} label
BL{<cond>} label

BX{<cond>} Rm

BLX{<cond>} label | Rm

AIEMS BIDADI 40 DR.PDT

 B Branch pc = label
BL branch with link pc = label
lr = address of the next instruction after the
BL
BX branch exchange pc = Rm & 0xfffffffe, T = Rm &1
pc = label, T =1
BLX branch exchange pc = Rm & 0xfffffffe, T = Rm &1
with link lr = address of the next instruction after the
▪ The BX instruction uses a Bn LaXbsolute address stored in register Rm.
- primarily used to branch to and from Thumb code
- T bit in the cpsr is updated by the least significant bit of the branch
register.

▪ The BLX instruction updates the T bit of the cpsr with the least significant
bit and additionally sets the link register with the return address.

AIEMS BIDADI 41 DR.PDT

AIEMS BIDADI 42 DR.PDT
LOAD-STORE INSTRUCTIONS

▪ transfer data between memory and processor registers

▪ There are three types of load-store instructions:
i. single-register transfer
ii. multiple-register transfer

iii. swap

AIEMS BIDADI 43 DR.PDT

SINGLE-REGISTER TRANSFER

▪ used for moving a single data item in and out of a register

▪ The datatypes supported are signed and unsigned words (32-bit),
halfwords (16-bit), and bytes.
▪ Syntax:

AIEMS BIDADI 44 DR.PDT

LDR load word into a register Rd <- mem32[address]
STR save byte or word from a register Rd -> mem32[address]
LDRB load byte into a register Rd <- mem8[address]
STRB save byte from a register Rd -> mem8[address]

LDRH load halfword into a register Rd <- mem16[address]

STRH save halfword from a register Rd -> mem16[address]
LDRSB load signed byte into a register Rd <- signExtend(mem8[address])

LDRSH load signed halfword into a Rd <- SignExtend (mem16[address])

register

AIEMS BIDADI 45 DR.PDT

▪ The first instruction loads a word from the address stored in register r1
and places it into register r0.
▪ The second instruction goes the other way by storing the contents of
register r0 to the address contained in register r1.
AIEMS BIDADI 46 DR.PDT
SINGLE-REGISTER LOAD-STORE ADDRESSING MODES

▪ The ARM instruction set provides different modes for addressing

memory.
▪ These modes incorporate one of the indexing methods:
1. preindex with writeback
2. preindex,
3. postindex

AIEMS BIDADI 47 DR.PDT

Ex: Preindex with writeback calculates an address from a base register plus address
offset and then updates that address base register with the new address.

AIEMS BIDADI 48 DR.PDT

 In contrast, the preindex offset is the same as the preindex with writeback
but does not update the address base register.

AIEMS BIDADI 49 DR.PDT

AIEMS BIDADI 50 DR.PDT
AIEMS BIDADI 51 DR.PDT
▪ The addressing modes available with a particular load or store instruction
depend on the instruction class.
▪ A signed offset or register is denoted by “+ /- ”, identifying that it is either a
positive or negative offset from the base address register Rn.
▪ The base address register is a pointer to a byte in memory, and the offset
specifies a number of bytes.

▪ Immediate means the address is calculated using the base address

register and a 12-bit offset encoded in the instruction.

▪ Register means the address is calculated using the base address

register and a specific register’s contents.

▪ Scaled means the address is calculated using the base address register
and a barrel shift operation.
AIEMS BIDADI 52 DR.PDT
AIEMS BIDADI 53 DR.PDT
AIEMS BIDADI 54 DR.PDT
MULTIPLE-REGISTER TRANSFER
▪ transfer multiple registers between memory and the processor in a
single instruction.
▪ The transfer occurs from a base address register Rn pointing into
memory.
▪ Multiple-register transfer instructions are more efficient from
single-register transfers for moving blocks of data around memory and
saving and restoring context and stacks.
▪ Syntax:
<LDM|STM>{<cond>}<addressing mode> Rn{!},<registers>{ˆ}

AIEMS BIDADI 55 DR.PDT

 load multiple {Rd}∗N <- mem32[start address + 4∗N]
LDM registers optional Rn updated
save multiple {Rd}∗N -> mem32[start address + 4∗N]
STM registers optional Rn updated

▪ The base register Rn determines the source or destination address for a

load- store multiple instruction.

AIEMS BIDADI 56 DR.PDT

AIEMS BIDADI 57 DR.PDT
▪ The base register r0 points to memory address 0x80010 in the PRE
condition.
▪ Memory addresses 0x80010, 0x80014, and 0x80018 contain the values
1, 2, and 3 respectively.

AIEMS BIDADI 58 DR.PDT

▪ After the load multiple instruction executes registers r1, r2, and r3
contain these values as shown in Figure below.

▪ The base register r0 now points to memory address 0x8001c after the
AIEMS BIDADI 59 DR.PDT
 last loaded word.

AIEMS BIDADI 60 DR.PDT

 LDMIB R0!, {R1-R3}

AIEMS BIDADI 61 DR.PDT

The first word pointed to by register r0 is ignored and register r1 is loaded
from the next memory location as shown in Figure below

▪ After execution, register r0 now points to the last loaded memory

location.
▪ This is in contrast with the LDMIA example, which pointed to the next
AIEMS BIDADI 62 DR.PDT
memory location.

AIEMS BIDADI 63 DR.PDT

▪ The decrement versions DA and DB of the load-store multiple
instructions decrement the start address and then store to
ascending memory locations.
▪ This is equivalent to descending memory but accessing the register
list in reverse order.
▪ With the increment and decrement load multiples, you can access
arrays forwards or backwards.
▪ They also allow for stack push and pull operations

AIEMS BIDADI 64 DR.PDT

AIEMS BIDADI 65 DR.PDT
AIEMS BIDADI 66 DR.PDT
▪ Figure 3.6 shows the memory map of the block memory copy and how
the routine moves through memory.

AIEMS BIDADI 67 DR.PDT

▪ This routine relies on registers r9, r10, and r11 being set up before the
code is executed. Registers r9 and r11 determine the data to be copied,
and register r10 points to the destination in memory for the data.
▪ LDMIA loads the data pointed to by register r9 into registers r0 to r7. It
also updates r9 to point to the next block of data to be copied.
▪ STMIA copies the contents of registers r0 to r7 to the destination memory
address pointed to by register r10. It also updates r10 to point to the next
destination location.
▪ CMP and BNE compare pointers r9 and r11 to check whether the end of
the block copy has been reached.
▪ If the block copy is complete, then the routine finishes; otherwise the
loop repeats with the updated values of register r9 and r10.
▪ The BNE is the branch instruction B with a condition mnemonic NE (not
equal).
▪ If the previous compare instruction sets the condition flags to not equal,
the branch instruction is executed.

AIEMS BIDADI 68 DR.PDT

 Stack Operations
• The ARM architecture uses the load-store multiple
instructions to carry out stack operations.
– The pop operation (removing data from a stack) uses a load
multiple instruction;
-- The push operation (placing data onto the stack) uses
a store multiple instruction
• We have to decide whether the stack will grow up or
down in memory. A stack is either
-- ascending (A) or
-- descending (D).
Ascending stacks grow towards higher memory
addresses;
Descending stacks grow towards lower memory
AIEMS BIDADI 69 DR.PDT
 addresses.

AIEMS BIDADI 70 DR.PDT

• In full stack (F), the stack pointer sp points to
an address that is the last used or full location
(i.e., sp points to the last item on the stack).
• In an empty stack (E) the sp points to an
address that is the first unused or empty
location (i.e., it points after the last item on
the stack).

AIEMS BIDADI 71 DR.PDT

▪ When you use a full stack (F), the stack pointer sp points to an address
that is the last used or full location (i.e., sp points to the last item on the
stack).

▪ In contrast, if you use an empty stack (E) the sp points to an address that
is the first unused or empty location (i.e., it points after the last item on
the stack).
▪ ARM has specified an ARM-Thumb Procedure Call Standard (ATPCS) that
defines how routines are called and how registers are allocated.
▪ In the ATPCS, stacks are defined as being full descending stacks.
▪ Thus, the LDMFD and STMFD instructions provide the pop and push
functions, respectively.

AIEMS BIDADI 72 DR.PDT

AIEMS BIDADI 73 DR.PDT
AIEMS BIDADI 74 DR.PDT
▪ When handling a checked stack there are three attributes that need to be
preserved: the stack base, the stack pointer, and the stack limit.

▪ The stack base is the starting address of the stack in memory.

▪ The stack pointer initially points to the stack base; as data is pushed onto the
stack, the stack pointer descends memory and continuously points to the top of
stack.

▪ If the stack pointer passes the stack limit, then a stack overflow error has
occurred.

▪ Here is a small piece of code that checks for stack overflow errors for a descending
stack:

; check for stack overflow

SUB sp, sp, #size

AIEMS BIDADI 75 DR.PDT

CMP sp, r10

BLLO _stack_overflow ; condition

AIEMS BIDADI 76 DR.PDT

▪ ATPCS defines register r10 as the stack limit or sl.
▪ This is optional since it is only used when stack checking is enabled.
▪ The BLLO instruction is a branch with link instruction plus the condition
mnemonic LO.
▪ If sp is less than register r10 after the new items are pushed onto the
stack, then stack overflow error has occurred.
▪ If the stack pointer goes back past the stack base, then a stack
underflow error has occurred.

AIEMS BIDADI 77 DR.PDT

SWAP INSTRUCTION
▪ The swap instruction is a special case of a load-store instruction.
▪ It swaps the contents of memory with the contents of a register.
▪ This instruction is an atomic operation—it reads and writes a location in
the same bus operation, preventing any other instruction from reading
or writing to that location until it completes.
▪ Syntax:
SWP{B}{<cond>} Rd,Rm,[Rn]

AIEMS BIDADI 78 DR.PDT

SWP swap a word between memory tmp = mem32[Rn]
and a register mem32[Rn] = Rm
Rd = tmp
SWPB swap a byte between memory tmp = mem8[Rn]
and a register mem8[Rn] = Rm
Rd = tmp

▪ Swap cannot be interrupted by any other instruction or any other bus

access.
▪ We say the system “holds the bus” until the transaction is complete.

AIEMS BIDADI 79 DR.PDT

▪ This instruction is particularly useful when implementing semaphores
and mutual exclusion in an operating system.

AIEMS BIDADI 80 DR.PDT

▪ The address pointed to by the semaphore either contains the value 0
or 1.
▪ When the semaphore equals 1, then the service in question is being
used by another process.
▪ The routine will continue to loop around until the service is released by
the other process—in other words, when the semaphore address
AIEMS BIDADI 81 DR.PDT
location contains the value 0.

AIEMS BIDADI 82 DR.PDT

SofTWARE INTERRUPT INSTRUCTION

▪ A software interrupt instruction (SWI) causes a software interrupt

exception, which provides a mechanism for applications to call
operating system routines.
▪ Syntax: SWI{<cond>} SWI_number

SWI software lr_svc = address of instruction following the SWI

interrupt spsr_svc = cpsr
pc = vectors + 0x8
cpsr mode = SVC
cpsr I = 1 (mask IRQ interrupts)

AIEMS BIDADI 83 DR.PDT

▪ When the processor executes an SWI instruction, it sets the program
counter pc to the offset 0x8 in the vector table.
▪ The instruction also forces the processor mode to SVC, which allows an
operating system routine to be called in a privileged mode.
▪ Each SWI instruction has an associated SWI number, which is used to
represent a particular function call or feature.

AIEMS BIDADI 84 DR.PDT

▪ SWI instructions are used to call operating system routines, you need
some form of parameter passing.
▪ This is achieved using registers. In this example, register r0 is used to pass
the parameter 0x12.

AIEMS BIDADI 85 DR.PDT

▪ The return values are also passed back via registers.

AIEMS BIDADI 86 DR.PDT

▪ Code called the SWI handler is required to process the SWI call. The
handler obtains the SWI number using the address of the executed
instruction, which is calculated from the link register lr.
▪ The SWI number is determined by
SWI_Number = <SWI instruction> AND NOT(0xff000000)
▪ Here the SWI instruction is the actual 32-bit SWI instruction executed
by the processor.

AIEMS BIDADI 87 DR.PDT

AIEMS BIDADI 88 DR.PDT
PROGRAM STATUS REGISTER INSTRUCTIONS
▪ The ARM instruction set provides two instructions to directly control a
program status register (psr).
▪ The MRS instruction transfers the contents of either the cpsr or spsr
into a register; in the reverse direction, the MSR instruction transfers
the contents of a register into the cpsr or spsr.
▪ Together these instructions are used to read and write the cpsr and
spsr.
▪ Syntax:

AIEMS BIDADI 89 DR.PDT

▪ In the syntax you can see a label called fields.
▪ This can be any combination of control (c), extension (x), status (s), and
flags (f ). These fields relate to particular byte regions in a psr, as shown
in Figure 3.9.

AIEMS BIDADI 90 DR.PDT

 MRS copy program status register to a Rd = psr
general-purpose register

MSR move a general-purpose register to a psr[field] = Rm

program status register

MSR move an immediate value to a psr[field] = immediate

program status register

▪ The c field controls the interrupt masks, Thumb state, and processor
mode.
▪ Example 3.26 shows how to enable IRQ interrupts by clearing the I
mask. This operation involves using both the MRS and MSR instructions

AIEMS BIDADI 91 DR.PDT

to read from and then write to the cpsr.

AIEMS BIDADI 92 DR.PDT

AIEMS BIDADI 93 DR.PDT
COPROCESSOR INSTRUCTIONS
▪ Coprocessor instructions are used to extend the instruction set.
▪ A coprocessor can either provide additional computation capability or
be used to control the memory subsystem including caches and memory
management.
▪ The coprocessor instructions include data processing, register transfer,
and memory transfer instructions
▪ Syntax:

AIEMS BIDADI 94 DR.PDT

 CDP coprocessor data processing—perform an operation
in a coprocessor
MRC MCR coprocessor register transfer—move data to/from
coprocessor registers
LDC STC coprocessor memory transfer—load and store blocks
of memory to/from a coprocessor
▪ In the syntax of the coprocessor instructions, the cp field represents the
coprocessor number between p0 and p15.
▪ The opcode fields describe the operation to take place on the
coprocessor.
▪ The Cn, Cm, and Cd fields describe registers within the coprocessor.
▪ The coprocessor operations and registers depend on the specific
coprocessor you are using.
▪ Coprocessor 15 (CP15) is reserved for system control purposes, such as
AIEMS BIDADI 95 DR.PDT
memory management, write buffer control, cache control, and

AIEMS BIDADI 96 DR.PDT

AIEMS BIDADI 97 DR.PDT
LOADING CONSTANTS
▪ there is no ARM instruction to move a 32-bit constant into a register.
▪ Since ARM instructions are 32 bits in size, they obviously cannot specify
a general 32-bit constant.
▪ To aid programming there are two pseudoinstructions to move a 32-bit
value into a register.
▪ Syntax:
LDR Rd, =constant
ADR Rd, label

AIEMS BIDADI 98 DR.PDT

 LDR load constant pseudoinstruction Rd = 32-bit constant

ADR load address pseudoinstruction Rd = 32-bit relative address

▪ The first pseudoinstruction writes a 32-bit constant to a register using

whatever instructions are available.
▪ It defaults to a memory read if the constant cannot be encoded using
other instructions.
▪ The second pseudoinstruction writes a relative address into a register,
which will be encoded using a pc-relative expression.

AIEMS BIDADI 99 DR.PDT

AIEMS BIDADI 100 DR.PDT
▪ The first conversion produces a simple MOV instruction; the second
conversion produces a pc-relative load.

AIEMS BIDADI 101 DR.PDT