第三讲 ARM指令集

第三节ARM指令集凌明东南大学国家专用集成电路系统工程技术研究中心trio@trio@WhydoweneedtoknowtheinstructionsetARMandThumbinstructionsetsweredesignedtogivethebestoutputfromcompilersEspeciallytheThumbInstructionsetMostdesigneffortformanysystemsisfocussedoncompiledcodeandknowledgeoftheinstructionsetisnotrequiredBut…..EmbeddedsystemsrequireinitialisationcodeandinterruptroutinesAllsystemsrequiredebugging–possiblyattheinstructionlevelPerformancegainscanbemadebywritingassemblerroutinesSomefeaturesoftheARMarchitecturearenotavailablewithcompilers目录ARM指令集汇编语言编程简介ARM指令集ARM指令集所有指令都是32位长许多指令都是单周期指令指令可条件执行LOAD/STORE架构例数据处理指令SUBr0,r1,#5ADDr2,r3,r3,LSL#2ANDSr4,r4,#0x20ADDEQr5,r5,r6特定的访问存储器的指令LDRR0,[R1],#4STRNEBr2,[r3,r4]LDRSHr5,[r6,#8]!STMFDsp!,{r0,r2-r7,r10}ARM指令的一般编码格式ARM指令字长为固定的32位。一条典型的ARM指令编码格式如图。Opcode 指令操作符编码Cond 指令执行的条件编码S 决定指令的操作是否影响CPSR的值Rd 目标寄存器编码Rn 包含第1个操作数的寄存器编码Shifter_operand 表示第二个操作数指令格式<opcode>{<cond>}{S}<Rd>,<Rn>{,<operand2>}ARMinstructionscanbemadetoexecuteconditionallybypost-fixingthemwiththeappropriateconditioncodeThiscanincreasecodedensityandincreaseperformancebyreducingthenumberofforwardbranches

CMPr0,r1ADDGTr2,r2,#1ADDLEr3,r3,#1Bydefault,dataprocessinginstructionsdonotaffecttheconditionflagsbutthiscanbeachievedbypostfixingtheinstruction(andanyconditioncode)withan“S”loopADDr2,r2,r3SUBSr1,r1,#0x01 BNE

loop

r2=r2+r3ifZflagclearthenbranchdecrementr1andsetflagsr0-r1,comparer0withr1andsetflagsif>r2=r2+1flagsremainunchangedif<=r3=r3+1flagsremainunchangedConditionalExecutionandFlagsConditionalexecutionexamplesif(r0==0){r1=r1+1;}else{r2=r2+1;}Csourcecode5instructions5words5or6cycles3instructions3words3cyclesCMPr0,#0BNEelseADDr1,r1,#1BendelseADDr2,r2,#1end...ARMinstructionsunconditionalCMPr0,#0ADDEQr1,r1,#1ADDNEr2,r2,#1...conditional条件码条件执行ARM指令可以通过增加条件执行码后缀来条件执行这样可以增加代码密度，看下面的例子CMPr3,r0# CMPr3,#0 BEQskip ADDNEr0,r1,r2ADDr0,r1,r2skip缺省情况下，数据处理指令不影响条件码标志，但是条件码标志可由“S”来设置，CMP不需要加“S”SUBSr1,r1,#1 r1减1并设置标志BNEloop 如果Z标志清除则跳转条件执行的例子使用一系列条件执行的指令If(a==0)func(1);CMP r0,#0MOVEQ r0,#1BLEQ func设置标志后使用不同的条件码If(a==0)x=0;If(a>0)x=1;CMP r0,#0MOVEQ r1,#0MOVGT r1,#1使用条件比较指令If(a==4||a==10) x=0;CMP r0,#4CMPNE r0,#10MOVEQ r1,#0DataprocessingInstructionsConsistof:Arithmetic: ADD ADC SUB SBC RSB RSCLogical: AND ORR EOR BICComparisons: CMP CMN TST TEQDatamovement: MOV MVNTheseinstructionsonlyworkonregisters,NOTmemory.Syntax:

<Operation>{<cond>}{S}Rd,Rn,Operand2Operand2canbearegisteroranimmediatevalueSUBr0,r1,r2 ANDr1,r4,#0xFFComparisonssetflagsonly-theydonotspecifyRdCMPr0,r3DatamovementdoesnotspecifyRnMOVr0,r1Operand2issenttotheALUviabarrelshifterRegister,optionallywithshiftoperationappliedShiftvaluecanbeeitherbe:5bitunsignedintegerSpecifiedinbottombyteofanotherregisterUsedformultiplicationbyconstantADDr0,r5,r5LSL1r0=r5x3Immediatevalue8bitnumber,witharangeof0-255.RotatedrightthroughevennumberofpositionsAllowsincreasedrangeof32-bitconstantstobeloadeddirectlyintoregistersResultOperand1Barrel

ShifterOperand2ALUTheSecondOperandShiftOperationsDestinationCF0DestinationCFLSL:LogicalLeftShiftASR:ArithmeticRightShiftMultiplicationbyapowerof2Divisionbyapowerof2,preservingthesignbitDestinationCF...0DestinationCFLSR:LogicalShiftRightROR:RotateRightDivisionbyapowerof2BitrotatewithwraparoundfromLSBtoMSBDestinationRRX:RotateRightExtendedSinglebitrotatewithwraparound

fromCFtoMSBCFTheseshiftoperationsareusedaspartofdataprocessinginstructions.bitscanbeshiftedfrom0-31places,typicallywithoutperformancepenaltyNoARMinstructioncancontaina32bitimmediateconstantAllARMinstructionsarefixedas32bitslongThedataprocessinginstructionformathas12bitsavailableforoperand24bitrotatevalue(0-15)ismultipliedbytwotogiverange0-30instepsof2Ruletorememberis

“8-bitsrotatedrightbyanevennumberofbitpositions”07118immed_8Shifter

RORrotx2QuickQuiz:

0xe3a004ff

MOVr0,#???Immediateconstants关于立即数的例子！汇编器把立即数转换为移位的方式MOVr0,#0x4096； 0x40循环右移26位ADDr1,r2,#0xFF0000； 0xFF循环右移16位不能够按照规则生成的立即数会导致错误Toallowlargerconstantstobeloaded,theassembleroffersapseudo-instruction:LDRrd,=constThiswilleither:ProduceaMOVorMVNinstructiontogeneratethevalue(ifpossible) orGenerateaLDRinstructionwithaPC-relativeaddresstoreadtheconstantfromaliteralpool(Constantdataareaembeddedinthecode)ForexampleLDRr0,=0xFF => MOVr0,#0xFFLDRr0,=0x55555555

=>

LDRr0,[PC,#Imm12]

…

…

DCD0x55555555ThisistherecommendedwayofloadingconstantsintoaregisterLoading32bitconstantsThereare2classesofmultiply-producing32-bitand64-bitresults32-bitversionsonanARM7TDMIwillexecutein2-5cyclesMULr0,r1,r2 ;r0=r1*r2MLAr0,r1,r2,r3 ;r0=(r1*r2)+r364-bitmultiplyinstructionsofferbothsignedandunsignedversionsFortheseinstructionthereare2destinationregisters[U|S]MULLr4,r5,r2,r3 ;r5:r4=r2*r3[U|S]MLALr4,r5,r2,r3 ;r5:r4=(r2*r3)+r5:r4MostARMcoresdonotofferintegerdivideinstructionsDivisionoperationswillbeperformedbyClibraryroutinesorinlineshiftsMultiplyandDivide乘法MUL{条件}{S} 目的寄存器，操作数1，操作数2例：MULS R0，R1，R2 ；R0=R1×R2，同时设置CPSR中的相关条件标志位MLA{条件}{S} 目的寄存器，操作数1，操作数2，操作数3MLAS R0，R1，R2，R3 ；R0=R1×R2+R3，同时设置CPSR中的相关条件标志位SMULL、SMLAL、UMULL、UMLAL等乘法指令的执行周期ARM7TDMI约为2－5个时钟周期StrongARM/XScale约为1－3个时钟周期ARM9E/ARM102xE约为2个时钟周期跳转指令B Label ；PC相对地址，32M范围。程序无条件跳转到标号Label处执行BL Label ；当程序无条件跳转到标号Label处执行时，同时将当前的PC值保存到R14中在LR中保存返回地址子程序返回时从LR中恢复PC存储在跳转指令中的实际值是相对当前PC值的一个偏移量，而不是一个绝对地址。它是24位有符号数，左移两位后有符号扩展为32位，表示的有效偏移为26位(前后32MB的地址空间)。利用相对PC的偏移量进行跳转的好处是可以生成PIC代码。如果跳转的空间超过32MB，如何处理？:BLfunc2::BXlrfunc1func2voidfunc1(void){

: func2(); :}子函数Implementingaconventionalsubroutinecallrequirestwosteps:StorethereturnaddressBranchtotheaddressoftherequiredsubroutineThesestepsarecarriedoutinoneinstruction,BLThereturnaddressisstoredinthelinkregister(lr/r14)Branchtoanaddressanywherewithina+/-32MBrangeReturningisperformedbyrestoringtheprogramcounter(pc)fromlr单寄存器数据传送LDR STR

Word

LDRB STRB

Byte

LDRH STRH

Halfword

LDRSB

SignedbyteloadLDRSH

SignedhalfwordloadMemorysystemmustsupportallaccesssizesSyntax:LDR{<cond>}{<size>}Rd,<address>STR{<cond>}{<size>}Rd,<address>e.g.LDREQBLDR/STR指令的寻址方式AddressaccessedbyLDR/STRisspecifiedbyabaseregisterwithanoffsetForwordandunsignedbyteaccesses,offsetcanbe:Anunsigned12-bitimmediatevalue(i.e.0-4095bytes)

LDRr0,[r1,#8]Aregister,optionallyshiftedbyanimmediatevalue

LDRr0,[r1,r2]

LDRr0,[r1,r2,LSL#2]Thiscanbeeitheraddedorsubtractedfromthebaseregister:

LDRr0,[r1,#-8]

LDRr0,[r1,-r2,LSL#2]Forhalfwordandsignedhalfword/byte,offsetcanbe:Anunsigned8bitimmediatevalue(i.e.0-255bytes)Aregister(unshifted)Choiceofpre-indexedorpost-indexedaddressingChoiceofwhethertoupdatethebasepointer(pre-indexedonly)

LDRr0,[r1,#-8]!

0x50x5r10x200Base

Register0x200r00x5Source

Register

forSTROffset120x20cr10x200Original

Base

Register0x200r00x5Source

Register

forSTROffset120x20cr10x20cUpdated

Base

RegisterAuto-updateform:

STRr0,[r1,#12]!PreorPostIndexedAddressing?

Pre-indexed:

STRr0,[r1,#12]

Post-indexed:

STRr0,[r1],#12关于前变址后变址的小结Word或者unsignedbyteHalfword,signedhalf,signedbyte寻址方式1语法1寻址方式2语法2立即数偏移前变址[Rn,#+/-offset_12]立即数偏移前变址[Rn,#+/-offset_8]寄存器偏移前变址[Rn,+/-Rm]寄存器偏移前变址[Rn,+/-Rm]比例寄存器偏移前变址[Rn,+/-Rm,shift_imm]立即数偏移回写前变址[Rn,#+/-offset_12]!立即数偏移回写前变址[Rn,#+/-offset_8]!寄存器回写前变址[Rn,+/-Rm]!寄存器回写前变址[Rn,+/-Rm]!比例寄存器回写前变址[Rn,+/-Rm,shift_imm]!立即数后变址[Rn],#+/-offset_12立即数后变址[Rn],#+/-offset_8寄存器后变址[Rn],+/-Rm寄存器后变址[Rn],+/-Rm比例寄存器后变址[Rn],+/-Rm,shift_immGeneratingBrancheswithLDRTheARM’sbranchinstructionislimitedtoarangeof±32MBHoweverbranchescanalsobeperformedbyloadingaddressvaluesdirectlyintothePC(r15)armasmprovidespseudoinstructionstomakethiseasier

AssemblerCodeLDRpc,=label;loadaddressoflabelintoPCARMASM

ObjectCode

LDRpc,[pc,#n] .--------------DCD0x12345678LiteralpooladdressdataBranchesanywherewithinthe4GBaddressspacearethuspossibleTheuseofbaseregisterupdatingenablessimplecopyingroutinestobewrittenForexample:Thepost-indexedvariantcouldbeusedtocopyablockofmemory;r8pointstostartofsourcedata;r9pointstoendofsourcedata;r10pointstostartofdestinationdataloop LDR r0,[r8],#4 ;load4bytes STR r0,[r10],#4 ;andstorethem CMP r8,r9 ;checkfortheend BLT loop ;elseloopInthisexample1wordiscopiedperiterationMemoryBlockCopying(1)IncreasingMemoryr9r8r10块数据传送批量加载和存储指令（LDM/STM）允许在存储器和16个寄存器之间传送数据寄存器的传送顺序不能任意指定低地址的内容总是总是传送到低寄存器例：LDMIAr10!,{r0,r1,r4}基址寄存器指定了访问存储器的地址这些指令有效的用于：在存储器中传送数据块在堆栈中保存和恢复上下文LDM/STM操作LDM（或STM）{条件}{类型}基址寄存器{！}，寄存器列表{∧}，例：LDMIAr12!,{r0-r11};由基址寄存器所指示的一片连续存储器到寄存器列表所指示的多个寄存器之间传送数据IA 每次传送后地址加1；IB 每次传送前地址加1；DA 每次传送后地址减1；DB 每次传送前地址减1；FD 满递减堆栈；ED 空递减堆栈；FA 满递增堆栈；EA 空递增堆栈；LoadandStoreMultiplesSyntax:<LDM|STM>{<cond>}<addressing_mode>Rb{!},<registerlist>4addressingmodes:LDMIA/STMIAincrementafter

LDMIB/STMIB incrementbefore

LDMDA/STMDAdecrementafter

LDMDB/STMDBdecrementbeforeIAr1Increasing

Addressr4r0r1r4r0r1r4r0r1r4r0r10IBDADBLDMxxr10,{r0,r1,r4}STMxxr10,{r0,r1,r4}BaseRegister(Rb)内存块拷贝！可以使得STM/LDM指令自动更新基址寄存器对于IA、IB，寄存器的内容加4对于DA、DB，寄存器的内容减4例：；r12指向源数据的起始地址；r14指向源数据的结束地址；r13指向目标数据的起始地址LoopLDMIAr12!,{r0-r11};STMIAr13!,{r0-r11};CMP r12,r14 BNE loopAswellasbeingusedforstackoperations,theSTM/LDM

instructionscanperformblockcopyingofmemoryForexample;r8pointstostartofsourcedata;r9pointstoendofsourcedata;r10pointstostartofdestinationdataloop LDMIA r8!,{r0-r7} ;load32bytes STMIA r10!,{r0-r7} ;andstorethem CMP r8,r9 ;checkfortheend BLT loop ;andloopInthisexample8wordsarecopiedperloopMemoryBlockCopying(2)IncreasingMemoryr9r8r10堆栈ARM的堆栈操作由块传送指令来实现STMFD （Push）批量存储－满递减堆栈LDMFD （Pop）批量加载－满递减堆栈例：STMFDsp!,{r4-r7,lr}；现场保存，将r4－r7、lr入栈例：LDMFDsp!,{r4-r7,pc}^；恢复现场，异常处理返回StacksLDMFDsp!,{r4-r7,pc}SP100FF1234AOBE80341010123484209753r41r514544r60r712lr9048pc9020r4100100FFr5FF1234r61234A0BEr7A0BE8034pc8034r4100r5FFr61234r7A0BElr8034ABCD8765102E16FFFF1010123484209753TopofMemorySPSP100FF1234A0BE8034SPOldSP100FF1234A0BE8034ARMstackoperationsareimplementedblocktransferinstructions:STMFD

(Push) StoreMultiple-FullDescendingstack[STMDB]LDMFD

(Pop) LoadMultiple-FullDescendingstack[LDMIA]Note:MultipleregisterswillalwaysbestackedinregisterorderfromlowestregistertolowestmemorylocationTheorderregistersarespecifiedhasnoeffect.STMFDsp!,{r4-r7,lr}LowAddressHighAddressAtomicoperationofamemoryreadfollowedbyamemorywritewhichmovesabyteorwordbetweenregisterandmemory.Syntax:SWP{<cond>}{B}Rd,Rm,[Rn]CanbeusedtoimplementflagsCannotbegeneratedfromCusingarmcc-mustuseassemblerRmRd321tempMemoryRnSWP数据交换指令（SWP）指令格式SWP{条件}目的寄存器，源寄存器1，[源寄存器2]例：SWP R0，R1，[R2] ；将R2所指向的存储器中的字数据传送到R0，同时将R1中的字数据传送到R2所指向的存储单元。SWP R0，R0，[R1] ；该指令完成将R1所指向的存储器中的字数据与R0中的字数据交换。可实现信号量操作I2C_SEM EQU 0x40003000I2C_SEM_WAITMOV R1,#0LDR R0,=I2C_SEMSWP R1,R1,[R0] ；取出信号量，并设置其为0CMP R1,#0 ；判断是否有信号BEQ I2C_SEM_WAIT ；若没有信号，则等待软件中断（SWI）产生一个软件中断异常SWI异常处理需要检查SWI号，以确定进行何种所请求的操作通过使用SWI机制，应用程序可以在用户模式下通过系统调用执行一系列特权操作。例：SWI 0x02 ；调用操作系统编号为02的系统调用例程。SoftwareInterrupt(SWI)CausesanexceptiontraptotheSWIhardwarevectorTheSWIhandlercanexaminetheSWInumbertodecidewhatoperationhasbeenrequested.ByusingtheSWImechanism,anoperatingsystemcanimplementasetofprivilegedoperationswhichapplicationsrunninginusermodecanrequest.Syntax:

SWI{<cond>}<SWInumber>283124270Cond1111SWInumber(ignoredbyprocessor)23ConditionFieldSWI中断处理程序实例SWI_handler ; ;保存寄存器r0~r12和lr ； STMFDsp!,{r0-r12,lr} ;读SWI指令 LDRr10,[lr,#-4] ；屏蔽高8位 BICr10,r10,#0xff000000 ;r10中是SWI号 BLservice_routine ;returnfromSWI LDMFDsp!,{r0-r12,pc}^

PSR传送指令MRS和MSR指令允许传送CPSR/SPSR的值到一个通用寄存器，或反之例：MRS R0，SPSR；传送SPSR的内容到R0在用户模式下，所有的位均可读，但是只有条件标志可写。协处理器指令ARM的体系结构支持16个协处理器每一个协处理器指令都占用ARM指令集的固定部分如果指令中的协处理器在系统中并不存在，会产生一个未定义指令异常有三种类型的协处理器指令协处理器数据处理CDP：初始化协处理器数据处理操作协处理器寄存器传送MRC：从协处理器寄存器传送到ARM寄存器MCR：从ARM寄存器传送到协处理器寄存器协处理器存储器传送指令LDC：从存储器中加载协处理器寄存器STC：把协处理器寄存器的值存到存储器中ARM指令集总结跳转指令数据处理指令乘法指令状态寄存器访问指令Load/Store内存访问指令批量Load/Store内存访问指令信号量操作指令SWI系统调用指令ARM协处理器指令ARM汇编语言伪指令ARM中伪指令不是真正的ARM指令，这些伪指令在汇编编译器堆源程序进行汇编处理时被替换成对应的ARM指令。ADR（小范围的地址读取伪指令）ADRL（中等范围的地址读取伪指令）LDR（大范围的地址读取伪指令）将一个32位的常数或者一个地址值读取到寄存器中LDRR1,=0x12345678NOP空操作伪指令ARM汇编语言编程ARM汇编的程序设计ARM汇编语言以段(section)为单位组织源文件；段是相对独立，具有特定名称，不可分割的指令或数据序列；段分为代码段和数据