ARM Architecture
ARM Architecture
Contents
Chapter A2
Programmers Model
A2.1
A2.2
A2.3
A2.4
A2.5
A2.6
A2.7
Chapter A3
Chapter A4
A3.8
A3.9
A3.10
A3.11
A3.12
A3.13
ARM Instructions
A4.1
A4.2
Chapter A5
Chapter A6
Chapter A7
A6.6
A6.7
A6.8
Thumb Instructions
A7.1
A7.2
Chapter A8
Chapter A9
Chapter A10
Chapter B2
Chapter B3
Chapter B4
Protection Unit
B4.1
B4.2
B4.3
Chapter B5
B5.6
Part A
CPU Architecture
Chapter A1
Introduction to the ARM Architecture
This chapter introduces the ARM architecture and contains the following sections:
A1-1
1.1
a load/store architecture, where data-processing operations only operate on register contents, not
directly on memory contents
simple addressing modes, with all load/store addresses being determined from register contents and
instruction fields only
control over both the Arithmetic Logic Unit (ALU) and shifter in every data-processing instruction
to maximize the use of an ALU and a shifter
These enhancements to a basic RISC architecture allow ARM processors to achieve a good balance of high
performance, low code size, low power consumption and low silicon area.
1.1.1
ARM registers
ARM has 31 general-purpose 32-bit registers. At any one time, 16 of these registers are visible. The other
registers are used to speed up exception processing. All the register specifiers in ARM instructions can
address any of the 16 visible registers.
The main bank of 16 registers is used by all unprivileged code. These are the User mode registers. User
mode is different from all other modes as it is unprivileged, which means:
A1-2
User mode is the only mode which cannot switch to another processor mode without generating an
exception
memory systems and coprocessors might allow User mode less access to memory and coprocessor
functionality than a privileged mode.
Register 14 is the Link Register (LR). This register holds the address of the next
instruction after a Branch and Link (BL) instruction, which is the instruction used
to make a subroutine call. At all other times, R14 can be used as a general-purpose
register.
Program counter
The remaining 14 registers have no special hardware purpose. Their uses are defined purely by software.
Software normally uses R13 as a Stack Pointer (SP).
For more details on registers, please refer to Registers on page A2-4.
1.1.2
Exceptions
ARM supports five types of exception, and a privileged processing mode for each type. The five types of
exceptions are:
fast interrupt
normal interrupt
memory aborts, which can be used to implement memory protection or virtual memory
software interrupt (SWI) instructions which can be used to make a call to an operating system.
When an exception occurs, some of the standard registers are replaced with registers specific to the
exception mode. All exception modes have replacement banked registers for R13 and R14. The fast
interrupt mode has more registers for fast interrupt processing.
When an exception handler is entered, R14 holds the return address for exception processing. This is used
to return after the exception is processed and to address the instruction that caused the exception.
Register 13 is banked across exception modes to provide each exception handler with a private stack pointer.
The fast interrupt mode also banks registers 8 to 12 so that interrupt processing can begin without the need
to save or restore these registers.
There is a sixth privileged processing mode, System mode, which uses the User mode registers. This is used
to run tasks that require privileged access to memory and/or coprocessors, without limitations on which
exceptions can occur during the task.
For more details on exceptions, please refer to Exceptions on page A2-13.
A1-3
1.1.3
Status registers
All processor state other than the general-purpose register contents is held in status registers. The current
operating processor status is in the Current Program Status Register (CPSR). The CPSR holds:
1 bit which encodes whether ARM or Thumb instructions are being executed.
Each exception mode also has a Saved Program Status Register (SPSR) which holds the CPSR of the task
immediately before the exception occurred. The CPSR and the SPSRs are accessed with special
instructions.
For more details on status registers, please refer to Program status registers on page A2-9.
A1-4
1.2
Branch instructions
tests for <, <=, >, and >= inequalities, in both signed and unsigned arithmetic
1.2.1
Branch instructions
As well as allowing many data-processing or load instructions to change control flow by writing the PC, a
standard Branch instruction is provided with a 24-bit signed offset, allowing forward and backward
branches of up to 32MB.
There is a Branch and Link (BL) option that also preserves the address of the instruction after the branch in
R14, the LR. This provides a subroutine call which can be returned from by copying the LR into the PC.
There are also branch instructions which can switch instruction set, so that execution continues at the branch
target using the Thumb instruction set. These allow ARM code to call Thumb subroutines, and ARM
subroutines to return to a Thumb caller. Similar instructions in the Thumb instruction set allow the
corresponding Thumb ARM switches. An overview of the Thumb instruction set is provided in Chapter
A6 The Thumb Instruction Set.
A1-5
1.2.2
Data-processing instructions
The data-processing instructions perform calculations on the general-purpose registers. There are four types
of data-processing instructions:
Arithmetic/logic instructions
Comparison instructions
Multiply instructions
Arithmetic/logic instructions
There are twelve arithmetic/logic instructions which share a common instruction format. These perform an
arithmetic or logical operation on up to two source operands, and write the result to a destination register.
They can also optionally update the condition code flags based on the result.
Of the two source operands:
an immediate value
Comparison instructions
There are four comparison instructions which use the same instruction format as the arithmetic/logic
instructions. These perform an arithmetic or logical operation on two source operands, but do not write the
result to a register. They always update the condition flags based on the result.
The source operands of comparison instructions take the same forms as those of arithmetic/logic
instructions, including the ability to incorporate a shift operation.
Multiply instructions
Multiply instructions come in two classes. Both types multiply two 32-bit register values and store their
result:
32-bit result
64-bit result
A1-6
1.2.3
1.2.4
In offset addressing, the memory address is formed by adding or subtracting an offset to or from the
base register value.
In pre-indexed addressing, the memory address is formed in the same way as for offset addressing.
As a side-effect, the memory address is also written back to the base register.
In post-indexed addressing, the memory address is the base register value. As a side-effect, an offset
is added to or subtracted from the base register value and the result is written back to the base register.
In each case, the offset can be either an immediate or the value of an index register. Register-based offsets
can also be scaled with shift operations.
As the PC is a general-purpose register, a 32-bit value can be loaded directly into the PC to perform a jump
to any address in the 4GB memory space.
A1-7
pre-increment
post-increment
pre-decrement
post-decrement.
The base address is specified by a register value, which can be optionally updated after the transfer. As the
subroutine return address and PC values are in general-purpose registers, very efficient subroutine entry and
exit sequences can be constructed with LDM and STM:
A single STM instruction at subroutine entry can push register contents and the return address onto
the stack, updating the stack pointer in the process.
A single LDM instruction at subroutine exit can restore register contents from the stack, load the PC
with the return address, and update the stack pointer.
LDM and STM instructions also allow very efficient code for block copies and similar data movement
algorithms.
By specifying the same register for steps 2 and 3, the contents of a memory location and a register are
interchanged.
The swap operation performs a special indivisible bus operation that allows atomic update of semaphores.
Both 32-bit word and 8-bit byte semaphores are supported.
1.2.5
Coprocessor instructions
There are three types of coprocessor instructions:
Data-processing instructions
These start a coprocessor-specific internal operation.
Data transfer instructions
These transfer coprocessor data to or from memory. The address of the transfer is calculated
by the ARM processor.
Register transfer instructions
These allow a coprocessor value to be transferred to or from an ARM register.
A1-8
1.2.6
Exception-generating instructions
Two types of instruction are designed to cause specific exceptions to occur.
Software interrupt instructions
SWI instructions cause a software interrupt exception to occur. These are normally used to
make calls to an operating system, to request an OS-defined service. The exception entry
caused by a SWI instruction also changes to a privileged processor mode. This allows an
unprivileged task to gain access to privileged functions, but only in ways permitted by the
OS.
Software breakpoint instructions
BKPT instructions cause an abort exception to occur. If suitable debugger software is
installed on the abort vector, an abort exception generated in this fashion is treated as a
breakpoint. If debug hardware is present in the system, it can instead treat a BKPT
instruction directly as a breakpoint, preventing the abort exception from occurring.
In addition to the above, the following types of instruction cause an Undefined Instruction exception to
occur:
most instruction words that have not yet been allocated a meaning as an ARM instruction.
In each case, this exception is normally used either to generate a suitable error or to initiate software
emulation of the instruction.
A1-9
A1-10
Chapter A2
Programmers Model
This chapter introduces the ARM programmers model. It contains the following sections:
A2-1
Programmers Model
2.1
Data types
ARM processors support the following data types:
Byte
8 bits.
Halfword
Word
Note
All three types are supported in ARM architecture version 4 and above. Only bytes and words were
supported prior to ARM architecture version 4.
When any of these types is described as unsigned, the N-bit data value represents a non-negative
integer in the range 0 to +2N-1, using normal binary format.
When any of these types is described as signed, the N-bit data value represents an integer in the range
-2N-1 to +2N-1-1, using two's complement format.
A2-2
All data operations, for example ADD, are performed on word quantities.
Load and store operations can transfer bytes, halfwords and words to and from memory,
automatically zero-extending or sign-extending bytes or halfwords as they are loaded.
ARM instructions are exactly one word (and are aligned on a four-byte boundary). Thumb
instructions are exactly one halfword (and are aligned on a two-byte boundary).
Programmers Model
2.2
Processor modes
The ARM architecture supports the seven processor modes shown in Table 2-1.
Table 2-1 ARM version 4 processor modes
Processor mode
Description
User
usr
FIQ
fiq
IRQ
irq
Supervisor
svc
Abort
abt
Undefined
und
System
sys
Runs privileged operating system tasks (ARM architecture version 4 and above)
Mode changes can be made under software control, or can be caused by external interrupts or exception
processing.
Most application programs execute in User mode. While the processor is in User mode, the program being
executed is unable to access some protected system resources or to change mode, other than by causing an
exception to occur (see Exceptions on page A2-13). This allows a suitably written operating system to
control the use of system resources.
The modes other than User mode are known as privileged modes. They have full access to system resources
and can change mode freely. Five of them are known as exception modes:
FIQ
IRQ
Supervisor
Abort
Undefined.
These are entered when specific exceptions occur. Each of them has some additional registers to avoid
corrupting User mode state when the exception occurs (see Registers on page A2-4 for details).
The remaining mode is System mode, and is only present in ARM architecture version 4 and above. It is not
entered by any exception and has exactly the same registers available as User mode. However, it is a
privileged mode and is therefore not subject to the User mode restrictions. It is intended for use by operating
system tasks which need access to system resources, but wish to avoid using the additional registers
associated with the exception modes. Avoiding such use ensures that the task state is not corrupted by the
occurrence of any exception.
A2-3
Programmers Model
2.3
Registers
The ARM processor has a total of 37 registers:
31 general-purpose registers, including a program counter. These registers are 32 bits wide and are
described in General-purpose registers on page A2-5.
6 status registers. These registers are also 32 bits wide, but only 12 of the 32 bits are allocated or need
to be implemented. These are described in Program status registers on page A2-9.
Registers are arranged in partially overlapping banks, with a different register bank for each processor
mode, as shown in Figure 2-1. At any time, 15 general-purpose registers (R0 to R14), one or two status
registers and the program counter are visible. Each column of Figure 2-1 shows which general-purpose and
status registers are visible in the indicated processor mode.
Modes
Privileged modes
Exception modes
User
System
Supervisor
Abort
Undefined
R0
R0
R0
R0
R0
R0
R0
R1
R1
R1
R1
R1
R1
R1
R2
R2
R2
R2
R2
R2
R2
R3
R3
R3
R3
R3
R3
R3
R4
R4
R4
R4
R4
R4
R4
R5
R5
R5
R5
R5
R5
R5
R6
R6
R6
R6
R6
R6
R6
R7
R7
R7
R7
R7
R7
R7
R8
R8
R8
R8
R8
R8
R8_fiq
R9
R9
R9
R9
R9
R9
R9_fiq
R10
R10
R10
R10
R10
R10
R10_fiq
R11
R11
R11
R11
R11
R11
R11_fiq
R12
R12
R12
R12
R12
R12
R12_fiq
R13
R13
R13_svc
R13_abt
R13_und
R13_irq
R13_fiq
R14
R14
R14_svc
R14_abt
R14_und
R14_irq
R14_fiq
PC
PC
CPSR
CPSR
PC
PC
CPSR
CPSR
SPSR_svc
SPSR_abt
PC
CPSR
SPSR_und
Interrupt
PC
Fast interrupt
PC
CPSR
CPSR
SPSR_irq
SPSR_fiq
indicates that the normal register used by User or System mode has
been replaced by an alternative register specific to the exception mode
Programmers Model
2.4
General-purpose registers
The general-purpose registers R0-R15 can be split into three groups. These groups differ in the way they
are banked and in their special-purpose uses:
Register 15, the PC, is described in The program counter, R15 on page A2-7.
2.4.1
2.4.2
Note
A few exceptions to this rule are noted in the individual instruction descriptions. Where a restriction exists
on the use of banked registers, it always applies to all of R8 to R14. For example, R8 to R12 are subject to
such restrictions even in systems in which FIQ mode is never used and so only one physical version of the
register is ever in use.
Registers R8 to R12 have two banked physical registers each. One is used in all processor modes other than
FIQ mode, and the other is used in FIQ mode. Where it is necessary to be specific about which version is
being referred to, the first group of physical registers are referred to as R8_usr to R12_usr and the second
group as R8_fiq to R12_fiq.
Registers R8 to R12 do not have any dedicated special purposes in the architecture. However, for interrupts
that are simple enough to be processed using registers R8 to R14 only, the existence of separate FIQ mode
versions of these registers allows very fast interrupt processing. Examples of this usage can be found in
Single-channel DMA transfer on page A9-13 and Dual-channel DMA transfer on page A9-13.
Registers R13 and R14 have six banked physical registers each. One is used in User and System modes,
while each of the remaining five is used in one of the five exception modes. Where it is necessary to be
specific about which version is being referred to, you use names of the form:
R13_<mode>
R14_<mode>
where <mode> is the appropriate one of usr, svc (for Supervisor mode), abt, und, irq and fiq.
A2-5
Programmers Model
Register R13 is normally used as a stack pointer and is also known as the SP. In the ARM instruction set,
this is by convention only, as there are no defined instructions or other functionality which use R13 in a
special-case manner. However, there are such instructions in the Thumb instruction set, as described in
Chapter A6 The Thumb Instruction Set.
Each exception mode has its own banked version of R13, which should normally be initialized to point to a
stack dedicated to that exception mode. On entry, the exception handler typically stores to this stack the
values of other registers to be used. By reloading these values into the registers when it returns, the
exception handler can ensure that it does not corrupt the state of the program that was being executed when
the exception occurred.
Register R14 (also known as the Link Register or LR) has two special functions in the architecture:
In each mode, the mode's own version of R14 is used to hold subroutine return addresses. When a
subroutine call is performed by a BL or BLX instruction, R14 is set to the subroutine return address.
The subroutine return is performed by copying R14 back to the program counter. This is typically
done in one of the two following ways:
MOV PC,LR
BX LR
On subroutine entry, store R14 to the stack with an instruction of the form:
STMFD SP!,{<registers>,LR}
and use a matching instruction to return:
LDMFD SP!,{<registers>,PC}
When an exception occurs, the appropriate exception mode's version of R14 is set to the exception
return address (offset by a small constant for some exceptions). The exception return is performed in
a similar way to a subroutine return, but using slightly different instructions to ensure full restoration
of the state of the program that was being executed when the exception occurred. See Exceptions on
page A2-13 for more details.
Note
When nested exceptions are possible, the two special-purpose uses might conflict. For example, if an IRQ
interrupt occurs when a program is being executed in User mode, none of the User mode registers are
necessarily corrupted. But if an interrupt handler running in IRQ mode re-enables IRQ interrupts and a
nested IRQ interrupt occurs, any value the outer interrupt handler is holding in R14_irq at the time is
overwritten by the return address of the nested interrupt.
System programmers need to be careful about such interactions. The usual way to deal with them is to
ensure that the appropriate version of R14 does not hold anything significant at times that nested exceptions
can occur. When this is hard to do in a straightforward way, it is usually best to change to another processor
mode during entry to the exception handler, before re-enabling interrupts or otherwise allowing nested
exceptions to occur. (In ARM architecture version 4 and above, System mode is usually the best mode to
use for this purpose.)
A2-6
Programmers Model
2.4.3
R1,
PC,
R0,
R0,
PC, #4
[R0]
[R0]
R0, R1
;
;
;
;
Note
The rules about how R15 is read apply only to reads by instructions. In particular, they do not necessarily
describe the values placed on a hardware address bus during instruction fetches. Like all other details of
hardware interfaces, such values are IMPLEMENTATION DEFINED.
A2-7
Programmers Model
In ARM architecture versions 3 and below, bits[1:0] of a value written to R15 are ignored, so that the
actual destination address of the instruction is (value written to R15) AND 0xFFFFFFFC.
In ARM architecture versions 4 and above, bits[1:0] of a value written to R15 in ARM state must be
0b00. If they are not, the results are UNPREDICTABLE.
Similarly, in T variants of ARM architecture versions 4 and above, Thumb instructions are required to be
halfword-aligned. Bit[0] of a value written to R15 in Thumb state is ignored, so that the actual destination
address of the instruction is (value written to R15) AND 0xFFFFFFFE.
Several instructions have their own rules for interpreting values written to R15. For example, BX and other
instructions designed to transfer between ARM and Thumb states use bit[0] of the value to select whether
to execute the code at the destination address in ARM state or Thumb state. Special rules of this type are
described on the individual instruction pages, and override the general rules in this section.
A2-8
Programmers Model
2.5
Note
User mode and System mode do not have an SPSR, because they are not exception modes. All instructions
which read or write the SPSR are UNPREDICTABLE when executed in User mode or System mode.
The format of the CPSR and the SPSRs is shown below.
31 30 29 28 27 26
N Z C V Q
2.5.1
DNM(RAZ)
6 5
1 0
M M M M M
I F T
4 3 2 1 0
Execution of some other arithmetic, logical or move instruction, where the destination register of the
instruction is not R15. Most of these instructions have both a flag-preserving and a flag-setting
variant, with the latter being selected by adding an S qualifier to the instruction mnemonic. Some of
these instructions only have a flag-preserving version. This is noted in the individual instruction
descriptions.
In either case, the new condition code flags (after the instruction has been executed) usually mean:
N
Is set to bit 31 of the result of the instruction. If this result is regarded as a two's complement
signed integer, then N = 1 if the result is negative and N = 0 if it is positive or zero.
Is set to 1 if the result of the instruction is zero (which often indicates an equal result from
a comparison), and to 0 otherwise.
For an addition, including the comparison instruction CMN, C is set to 1 if the addition
produced a carry (that is, an unsigned overflow), and to 0 otherwise.
A2-9
Programmers Model
For non-addition/subtractions that incorporate a shift operation, C is set to the last bit
shifted out of the value by the shifter.
Execution of an MSR instruction, as part of its function of writing a new value to the CPSR or SPSR.
Execution of MRC instructions with destination register R15. The purpose of such instructions is to
transfer coprocessor-generated condition code flag values to the ARM processor.
Execution of some variants of the LDM instruction. These variants copy the SPSR to the CPSR, and
their main intended use is for returning from exceptions.
Execution of flag-setting variants of arithmetic and logical instructions whose destination register is
R15. These also copy the SPSR to the CPSR, and are mainly intended for returning from exceptions.
The Q flag
In E variants of ARM architecture 5 and above, bit[27] of the CPSR is known as the Q flag and is used to
indicate whether overflow and/or saturation has occurred in some of the enhanced DSP instructions.
Similarly, bit[27] of each SPSR is a Q flag, and is used to preserve and restore the CPSR Q flag if an
exception occurs. For more details of the Q flag, see Chapter A10 Enhanced DSP Extension.
In architecture versions prior to version 5, and in non-E variants of architecture version 5 and above, bit[27]
of the CPSR and SPSRs should be treated as described in Other bits on page A2-12.
2.5.2
A2-10
I bit
F bit
Programmers Model
The T bit
The T bit should be zero (SBZ) on ARM architecture version 3 and below, and on non-T variants of ARM
architecture version 4. No instructions exist in these architectures that can switch between ARM and Thumb
states.
On T variants of ARM architecture 4 and above, the T bit has the following meanings:
T=0
T=1
Instructions that switch between ARM and Thumb states can be used freely on implementations of these
architectures.
On non-T variants of ARM architecture version 5 and above, the T bit has the following meanings:
T=0
T=1
Forces the next instruction executed to cause an undefined instruction exception (see
Undefined Instruction exception on page A2-15).
Instructions that switch between ARM and Thumb states can be used on implementations of these
architectures, but only function correctly as long as the program remains in ARM state. If the program
attempts to switch to Thumb state, the first instruction executed after the attempted switch causes an
undefined instruction exception. Entry into that exception then switches back to ARM state. The exception
handler can detect that this was the cause of the exception from the fact that the T bit of SPSR_und is set.
Mode bits
M0, M1, M2, M3, and M4 (M[4:0]) are the mode bits, and these determine the mode in which the processor
operates. Their interpretation is shown in Table 2-2.
Table 2-2 The mode bits
M[4:0]
Mode
Accessible registers
0b10000
User
0b10001
FIQ
0b10010
IRQ
0b10011
Supervisor
0b10111
Abort
0b11011
Undefined
0b11111
System
A2-11
Programmers Model
Not all combinations of the mode bits define a valid processor mode. Only those combinations explicitly
described can be used. If any other value is programmed into the mode bits M[4:0], the result is
UNPREDICTABLE. See also Table 8-1 on page A8-9 for details of the mode bits in the 26-bit architectures.
2.5.3
Other bits
Other bits in the program status registers are reserved for future expansion. In general, programmers must
take care to write code in such a way that these bits are never modified. Failure to do this might result in
code which has unexpected side-effects on future versions of the architecture. See the usage notes for the
MSR instruction on page A4-62 for more details.
A2-12
Programmers Model
2.6
Exceptions
Exceptions are generated by internal and external sources to cause the processor to handle an event, such as
an externally generated interrupt or an attempt to execute an undefined instruction. The processor state just
before handling the exception must be preserved so that the original program can be resumed when the
exception routine has completed. More than one exception can arise at the same time.
ARM supports seven types of exception. Table 2-3 lists the types of exception and the processor mode that
is used to process that exception. When an exception occurs, execution is forced from a fixed memory
address corresponding to the type of exception. These fixed addresses are called the exception vectors.
Note
The normal vector at address 0x00000014 and the high vector at address 0xFFFF0014 are not normally
used and are reserved for future expansion. The reserved vector at address 0x00000014 was used for an
Address Exception vector in earlier versions of the ARM architecture which had a 26-bit address space. See
Chapter A8 The 26-bit Architectures for more information.
Mode
Normal
address
High vector
address
Reset
Supervisor
0x00000000
0xFFFF0000
Undefined instructions
Undefined
0x00000004
0xFFFF0004
Supervisor
0x00000008
0xFFFF0008
Abort
0x0000000C
0xFFFF000C
Abort
0x00000010
0xFFFF0010
IRQ (interrupt)
IRQ
0x00000018
0xFFFF0018
FIQ
0x0000001C
0xFFFF001C
When an exception occurs, the banked versions of R14 and the SPSR for the exception mode are used to
save state as follows:
R14_<exception_mode> = return link
SPSR_<exception_mode> = CPSR
CPSR[4:0] = exception mode number
CPSR[5] = 0
if <exception_mode> == Reset or FIQ then
CPSR[6] = 1
/* else CPSR[6] is unchanged */
CPSR[7] = 1
PC = exception vector address
A2-13
Programmers Model
To return after handling the exception, the SPSR is moved into the CPSR, and R14 is moved to the PC. This
can be done atomically in two ways:
using a data-processing instruction with the S bit set, and the PC as the destination
using the Load Multiple with Restore CPSR instruction, as described in LDM (3) on page A4-34.
The following sections show what happens automatically when the exception occurs, and also show the
recommended data-processing instruction to use to return from each exception. This instruction is always a
MOVS or SUBS instruction with the PC as its destination.
Note
When the recommended data-processing instruction is a SUBS and a Load Multiple with Restore CPSR
instruction is used to return from the exception handler, the subtraction must still be performed. This is
usually done at the start of the exception handler, before the return link is stored to memory.
For example, an interrupt handler that wishes to store its return link on the stack might use instructions of
the following form at its entry point:
SUB
STMFD
R14, R14, #4
SP!, {<other_registers>, R14}
2.6.1
Reset
When the Reset input is asserted on the processor, the ARM processor immediately stops execution of the
current instruction. When Reset is de-asserted, the following actions are performed:
R14_svc
= UNPREDICTABLE value
SPSR_svc = UNPREDICTABLE value
CPSR[4:0] = 0b10011
CPSR[5]
= 0
CPSR[6]
= 1
CPSR[7]
= 1
if high vectors configured then
PC
= 0xFFFF0000
else
PC
= 0x00000000
/*
/*
/*
/*
After Reset, the ARM processor begins execution at address 0x00000000 or 0xFFFF0000 in Supervisor
mode with interrupts disabled. See About the MMU architecture on page B3-2 for more information on the
effects of Reset.
Note
There is no architecturally defined way of returning from a Reset.
A2-14
Programmers Model
2.6.2
This restores the PC (from R14_und) and CPSR (from SPSR_und) and returns to the instruction following
the undefined instruction.
In some coprocessor designs, an internal exceptional condition caused by one coprocessor instruction is
signaled imprecisely by refusing to respond to a later coprocessor instruction. In these circumstances, the
Undefined Instruction handler takes whatever action is necessary to clear the exceptional condition, then
returns to the second coprocessor instruction. To do this use:
SUBS PC,R14,#4
A2-15
Programmers Model
2.6.3
To return after performing the SWI operation, use the following instruction to restore the PC
(from R14_svc) and CPSR (from SPSR_svc) and return to the instruction following the SWI:
MOVS PC,R14
2.6.4
This restores both the PC (from R14_abt) and CPSR (from SPSR_abt), and returns to the aborted
instruction.
A2-16
Programmers Model
2.6.5
This restores both the PC (from R14_abt) and CPSR (from SPSR_abt), and returns to re-execute the aborted
instruction.
If the aborted instruction does not need to be re-executed use:
SUBS PC,R14,#4
unchanged if the memory system does not permit write access to the memory location
UNPREDICTABLE otherwise.
Instructions that access data memory can modify registers in three ways:
By loading values into one or more of the general-purpose registers, which can include the PC.
By specifying base register writeback, in which the base register used in the address calculation has
a modified value written to it. All instructions that allow this to be specified have UNPREDICTABLE
results if base register writeback is specified and the base register is the PC, so only general-purpose
registers other than the PC can legitimately be modified in this way.
If a Data Abort occurs, the values left in these registers are determined by the following rules:
1.
The PC value on entry to the data abort handler is 0x00000010 or 0xFFFF0010, and the R14_abt
value is determined from the address of the aborted instruction. Neither is affected in any way by the
results of any PC load specified by the instruction.
A2-17
Programmers Model
2.
If base register writeback is not specified, the base register value is unchanged. This applies even if
the instruction loaded its own base register and the memory access to load the base register occurred
earlier than the aborting access.
For example, suppose the instruction is:
LDMIA R0,{R0,R1,R2}
and the implementation loads the new R0 value, then the new R1 value and finally the new R2 value.
If a Data Abort occurs on any of the accesses, the value in the base register R0 of the instruction is
unchanged. This applies even if it was the load of R1 or R2 that aborted, rather than the load of R0.
3.
If base register writeback is specified, the value left in the base register is determined by the abort
model of the implementation, as described in Abort models.
4.
If the instruction only loads one general-purpose register, the value in that register is unchanged.
5.
If the instruction loads more than one general-purpose register, UNPREDICTABLE values are left in
destination registers which are neither the PC nor the base register of the instruction.
6.
If the instruction loads coprocessor registers, UNPREDICTABLE values are left in the destination
coprocessor registers, unless otherwise specified in the instruction set description of the specific
coprocessor.
Abort models
The abort model used by an ARM implementation is IMPLEMENTATION DEFINED, and is one of the
following:
Base Restored Abort Model
If a Data Abort occurs in an instruction which specifies base register writeback, the value in
the base register is unchanged.
Base Updated Abort Model
If a Data Abort occurs in an instruction which specifies base register writeback, the base
register writeback still occurs.
In either case, the abort model applies uniformly across all instructions. An implementation does not use the
Base Restored Abort Model for some instructions and the Base Updated Abort Model for others.
Note
In some ARMv3 and earlier implementations, a third abort model (the Early Abort Model) was used. In this
model, base register writeback occurred for LDC, LDM, STC and STM instructions, and the base register was
unchanged for all other instructions.
The Early Abort Model is not valid in ARM architecture versions 3M, 4 and above.
Some of these implementations optionally allowed a Late Abort Model to be selected. This is identical to
the Base Updated Abort Model.
A2-18
Programmers Model
2.6.6
Note
The I bit can only be changed from a privileged mode.
When an IRQ is detected, the following actions are performed:
R14_irq
= address of next instruction to be executed + 4
SPSR_irq = CPSR
CPSR[4:0] = 0b10010
/* Enter IRQ mode */
CPSR[5]
= 0
/* Execute in ARM state */
/* CPSR[6] is unchanged */
CPSR[7]
= 1
/* Disable normal interrupts */
if high vectors configured then
PC
= 0xFFFF0018
else
PC
= 0x00000018
This restores both the PC (from R14_irq) and CPSR (from SPSR_irq), and resumes execution of the
interrupted code.
2.6.7
Note
The F bit can only be changed from a privileged mode.
When an FIQ is detected, the following actions are performed:
A2-19
Programmers Model
R14_fiq
= address of next instruction to be executed + 4
SPSR_fiq = CPSR
CPSR[4:0] = 0b10001
/* Enter FIQ mode */
CPSR[5]
= 0
/* Execute in ARM state */
CPSR[6]
= 1
/* Disable fast interrupts */
CPSR[7]
= 1
/* Disable normal interrupts */
if high vectors configured then
PC
= 0xFFFF001C
else
PC
= 0x0000001C
This restores both the PC (from R14_fiq) and CPSR (from SPSR_fiq), and resumes execution of the
interrupted code.
The FIQ vector is deliberately the last vector to allow the FIQ exception-handler software to be placed
directly at address 0x0000001C or 0xFFFF001C, without requiring a branch instruction from the vector.
2.6.8
Exception priorities
Table 2-4 shows the exception priorities:
Table 2-4 Exception priorities
Priority
Highest
Lowest
Exception
1
Reset
Data Abort
FIQ
IRQ
Prefetch Abort
Undefined instruction
SWI
Undefined instruction and software interrupt cannot occur at the same time, as they each correspond to
particular (non-overlapping) decodings of the current instruction, and both must be lower priority than
prefetch abort, as a prefetch abort indicates that no valid instruction was fetched.
The priority of a Data Abort exception is higher than FIQ, which ensures that the data abort handler is
entered before the FIQ handler is entered (so that the Data Abort is resolved after the FIQ handler has
completed).
A2-20
Programmers Model
2.6.9
High vectors
Some ARM implementations allow the exception vector locations to be moved from their normal address
range 0x00000000-0x0000001C at the bottom of the 32-bit address space, to an alternative address
range 0xFFFF0000-0xFFFF001C near the top of the address space. These alternative locations are
known as the high vectors.
It is IMPLEMENTATION DEFINED whether the high vectors are supported. When they are, a hardware
configuration input selects whether the normal vectors or the high vectors are to be used.
The ARM instruction set does not contain any instructions which can directly change whether normal or
high vectors are configured. However, if the standard System Control coprocessor is attached to an ARM
processor which supports the high vectors, bit[13] of coprocessor 15 register 1 can be used to switch
between using the normal vectors and the high vectors (see Register 1: Control register on page B2-13).
A2-21
Programmers Model
2.7
2.7.1
It might cause difficulties in porting the system (hardware and/or software) to future ARM
processors.
Standard software (such as compilers and other software toolkit components) might not work with
the rule-breaking system.
Address space
The ARM architecture uses a single, flat address space of 232 8-bit bytes. Byte addresses are treated as
unsigned numbers, running from 0 to 232 - 1.
This address space is regarded as consisting of 230 32-bit words, each of whose addresses is word-aligned,
which means that the address is divisible by 4. The word whose word-aligned address is A consists of the
four bytes with addresses A, A+1, A+2 and A+3.
In ARM architecture version 4 and above, the address space is also regarded as consisting of 231 16-bit
halfwords, each of whose addresses is halfword-aligned (divisible by 2). The halfword whose
halfword-aligned address is A consists of the two bytes with addresses A and A+1.
Note
Prior to ARM architecture version 3, the address space was only 226 bytes, with addresses running from 0
to 226 - 1. This address space was split into 224 words.
Some implementations of subsequent non-T variants of the ARM architecture include
backwards-compatibility features to allow execution of code written for this address space. These features
are described in Chapter A8 The 26-bit Architectures. Their use for any purpose other than executing old
code is strongly discouraged.
These backwards-compatibility features are not compatible with T variants of the architecture, due to
conflicting uses of bits[1:0] of R15.
A2-22
Programmers Model
Address calculations are normally performed using ordinary integer instructions. This means that they
normally wrap around if they overflow or underflow the address space. This means that the result of the
calculation is reduced modulo 232. However, to minimize the chances of incompatibility if the address space
is extended in the future, programs should not be written so that they rely on this behavior. Address
calculations should be written so that their results would still lie in the range 0 to 232 - 1 if they were
calculated without wrap-around.
Most branch instructions calculate their targets by adding an instruction-specified offset to the value of the
PC and writing the result back to the PC. If the overall effect of this calculation of:
(address_of_current_instruction) + 8 + offset
is to overflow or underflow the address space, the instruction is technically UNPREDICTABLE because it relies
on address wrap-around. The result of this is that forward branches past address 0xFFFFFFFF and
backward branches past address 0x00000000 should not be used.
Also, normal sequential execution of instructions effectively calculates:
(address_of_current_instruction) + 4
after each instruction to determine which instruction to execute next. If this calculation overflows the top of
the address space, the result is again technically UNPREDICTABLE. In other words, programs should not rely
on sequential execution of the instruction at address 0x00000000 after the instruction at address
0xFFFFFFFC.
Note
The above only applies to instructions that are executed, including those which fail their condition code
check. Most ARM implementations prefetch instructions ahead of the currently-executing instruction. If
this prefetching overflows the top of the address space, it does not cause the implementations behavior to
become UNPREDICTABLE until and unless the prefetched instructions are actually executed.
LDC, LDM, STC, and STM instructions access a sequence of words at increasing memory addresses,
effectively incrementing a memory address by 4 for each load or store. If this calculation overflows the top
of the address space, the result is again technically UNPREDICTABLE. In other words, programs should not
use these instructions in such a way that they access the word at address 0x00000000 sequentially after
the word at address 0xFFFFFFFC.
2.7.2
Endianness
The rules in Address space on page A2-22 require that for a word-aligned address A:
The word at address A consists of the bytes at addresses A, A+1, A+2 and A+3.
The halfword at address A+2 consists of the bytes at addresses A+2 and A+3.
The word at address A therefore consists of the halfwords at addresses A and A+2.
However, this does not totally specify the mappings between words, halfwords and bytes.
A2-23
Programmers Model
A memory system uses one of the two following mapping schemes. This choice is known as the endianness
of the memory system.
a byte or halfword at a word-aligned address is the least significant byte or halfword within
the word at that address
a byte at a halfword-aligned address is the least significant byte within the halfword at that
address.
a byte or halfword at a word-aligned address is the most significant byte or halfword within
the word at that address
a byte at a halfword-aligned address is the most significant byte within the halfword at that
address.
For a word-aligned address A, Table 2-5 and Table 2-6 show how the word at address A, the halfwords at
addresses A and A+2, and the bytes at addresses A, A+1, A+2 and A+3 map on to each other for each
endianness.
Table 2-5 Big-endian memory system
31
24 23
16 15
Word at address A
Halfword at address A
Byte at address A
20 19
12 11 10 9 8
4 3
Word at address A
Halfword at address A+2
Byte at address A+3
Halfword at address A
Byte at address A+1
Byte at address A
A2-24
Programmers Model
The ARM instruction set does not contain any instructions that directly select the endianness. Instead, an
ARM implementation which supports both endiannesses has a hardware input to configure it to match the
endianness of the attached memory system. If a standard System Control coprocessor is attached to such an
ARM implementation, this configuration input can be changed by writing to bit[7] of register 1 of the
System Control coprocessor (see Register 1: Control register on page B2-13).
If an ARM implementation is configured for a memory system of one endianness but is actually attached to
a memory system of the opposite endianness, only word-sized instruction fetches, data loads and data stores
can be relied upon. Other memory accesses have UNPREDICTABLE results.
When the standard System Control coprocessor is attached to an ARM processor that supports both
endiannesses, bit[7] of the coprocessors register 1 is cleared on reset. This means that the ARM processor
is configured for a little-endian memory system immediately after reset. If it is attached to a big-endian
memory system, one of the first things the reset handler must do is switch the configured endianness to
big-endian, using an instruction sequence like:
MRC
ORR
MCR
; r0 := CP15 register 1
; Set bit[7] in r0
; CP15 register 1 := r0
This must be done before there is any possibility of a byte or halfword data access occurring, or of a Thumb
instruction being executed.
Note
The rules on endianness imply that word loads and stores are not affected by the configured endianness.
Because of this, it is not possible to reverse the order of the bytes in a word by storing it, changing the
configured endianness, and reloading the stored word. Instead, use one of the code sequences in Swapping
endianness on page A9-4.
More generally, there is no point in changing the configured endianness of an ARM processor to be different
from that of the memory system it is attached to, because no additional architecturally defined operations
become available as a result of doing so. So normally, the only time the configured endianness is changed
is at reset to make it match the memory system endianness.
A2-25
Programmers Model
2.7.3
It is UNPREDICTABLE.
It ignores the low-order address bits that make the access unaligned. This means it effectively uses
the formula (address AND 0xFFFFFFFE) for a halfword access, and uses the formula
(address AND 0xFFFFFFFC)for a word access.
It ignores the low-order address bits that make the access unaligned for the memory access itself, but
then uses those low-order bits to control a rotation of the loaded data. (This behavior applies only to
the LDR and SWP instructions.)
Which of these three options applies to a load/store instruction depends on which instruction it is, and is
documented on the individual instruction pages.
ARM implementations are not required to ensure that the low-order address bits that make an access
unaligned are cleared from the address they send to memory. They can instead send the address as calculated
by the load/store instruction unchanged to memory, and require the memory system to ignore address[0] for
a halfword access and address[1:0] for a word access.
Note
When an instruction ignores the low-order address bits that make an access unaligned, the pseudo-code in
the instruction description does not mask them out explicitly. Instead, the Memory[<address>,<size>]
function used in the pseudo-code masks them out implicitly. This function is defined in the Glossary.
A2-26
Programmers Model
2.7.4
When an exception occurs, execution of the current instruction is completed, all further prefetched
instructions are discarded, and execution of the instructions at the exception vector is started.
When a branch is taken, any instructions that have already been prefetched from sequential locations
beyond the branch are discarded.
ARM implementations are free to choose how far ahead of the current point of execution they prefetch
instructions, or even to have a dynamically varying number of prefetched instructions. The original ARM
implementation prefetched two instructions ahead of the instruction currently being executed, but
implementations are free to choose to prefetch more or less than this.
Note
When an instruction reads the PC, it gets the address of the instruction that is two after itself:
r0, AddInstr
r0, NextInstr
r1, r1, #1
r1, r1, #1
A2-27
Programmers Model
However, the instruction executed after the STR instruction is normally the SUB instruction on the first
occasion that this code is executed, because the SUB instruction was prefetched before the instruction in
memory was changed. The ADD instruction is not executed until the second time that the code sequence is
executed.
Furthermore, even this behavior cannot be guaranteed, because:
On the first occasion that the code sequence is executed, it is possible that an interrupt will occur
immediately after the STR. If it does, the SUB instruction that had been prefetched is discarded. When
the interrupt handler returns, the instruction at NextInstr is prefetched again, and is the ADD
instruction this time. So while the SUB instruction is normally executed on the first occasion that the
code is executed, it is possible that the ADD instruction is executed instead.
Either the ARM processor or the memory system is allowed to keep copies of instructions fetched
from memory and use those copies instead of repeating the instruction fetch if the instruction is
executed again. If this occurs, a copy of the SUB instruction can be executed on the second or
subsequent occasion that the code sequence is executed.
The main reason that this might occur is that the memory system contains separate instruction and
data caches (see Instruction cache coherency on page B5-11). However, other possibilities also exist.
For example, some forms of branch prediction hardware keep copies of the instructions at branch
targets.
The overall result is that code which writes one or more instructions to memory and then executes them
(known as self-modifying code) cannot be executed reliably on ARM processors without special
precautions. Programming techniques that involve the use of self-modifying code are to be avoided as far
as possible.
A2-28
Programmers Model
Also, in many implementations, the IMB sequence includes operations that are only usable from privileged
processor modes, such as the cache cleaning and invalidation operations supplied by the standard System
Control coprocessor (see Chapter B5 Caches and Write Buffers). To allow User mode programs to use the
IMB sequence, it is recommended that it is supplied as an operating system call, invoked by a SWI
instruction.
In systems that use the 24-bit immediate in a SWI instruction to specify the required operating system
service, it is recommended that the IMB sequence is requested by the instruction:
SWI 0xF00000
This call takes no parameters and does not return a result, and should use the same calling conventions as a
call to a C function with prototype:
void IMB(void);
apart from the fact that a SWI instruction is used for the call, rather than a BL instruction.
Some implementations can use knowledge of the range of addresses to which new instructions have been
stored to reduce the execution time cost of an IMB. It is therefore also recommended that a second operating
system call is supplied which does an IMB with respect to a specified address range only. On systems that
use the 24-bit immediate in a SWI instruction to specify the required operating system service, this should
be requested by the instruction:
SWI 0xF00001
and should use similar calling conventions to those used by a call to a C function with prototype:
void IMB_Range(unsigned long start_addr, unsigned long end_addr);
where the address range runs from start_addr (inclusive) to end_addr (exclusive).
Note
When the standard ARM Procedure Calling Standard is used, this means that start_addr is
passed in R0 and end_addr in R1.
On some ARM implementations, the execution time cost of an IMB can be very large (many
thousands of clock cycles), even when a small address range is specified. For small scale uses of
self-modifying code, this is likely to lead to a major loss of performance. It is therefore recommended
that self-modifying code is only used where it is unavoidable and/or it produces sufficiently large
execution time benefits to offset the cost of the IMB.
A2-29
Programmers Model
An exception occurs in User mode, causing the processor to switch to a privileged mode.
Execution of one of the instructions designed for exception return causing a change from a privileged
mode to User mode. These instructions are the ones which have a side-effect of copying the SPSR of
the current mode to the CPSR, namely:
The data processing instructions ADCS, ADDS, ANDS, BICS, EORS, MOVS, MVNS, ORRS,
RSBS, RSCS, SBCS and SUBS when their destination register is R15. (However, only MOVS
and SUBS are commonly used for exception return.)
The form of the LDM instruction described in LDM (3) on page A4-34.
The same is not guaranteed in the remaining cases where memory access permissions might change between
prefetching and executing an instruction. These are:
A2-30
Programmers Model
However, the cost of a full IMB can often be avoided in these cases. In particular, the instruction word
associated with any particular address has not changed, so it is usually possible to avoid cache flushes. An
implementation can therefore define restricted versions of the IMB sequence to be used in these cases.
In the case of an MSR instruction changing from a privileged mode to User mode, a restricted version of the
IMB sequence that works on all ARM processors to date is simply to execute any instruction that writes to
the PC, other than the branch instructions described in the following sections:
B, BL on page A4-10
For each branch from the above list that can be reached in this way, execution of the instruction at its
target. (The branch instructions in the list are precisely those that have a fixed, statically determined
target.)
This set of instructions is occasionally referred to elsewhere in this manual as the set of instructions that can
be reached by predictable subsequent execution from the MSR instruction.
2.7.5
Memory-mapped I/O
The standard way to perform I/O functions on ARM systems is by the use of memory-mapped I/O. This uses
special memory addresses which supply I/O functions when they are loaded from or stored to. Typically,
loading from a memory-mapped I/O address is used for input, and storing to a memory-mapped I/O address
is used for output. Both loads and stores can also be used to perform control functions, either instead of or
in addition to their normal input or output function.
The behavior of a memory-mapped I/O location usually differs from that expected of a normal memory
location. For example, two successive loads from a normal memory location return the same value each time
unless there has been an intervening store to that location. For a memory-mapped I/O location, the value
returned by the second load can be different from the value returned by the first load. Typically, this is
because the first load has a side-effect (such as removing the loaded value from a buffer) or because of a
side-effect of an intervening load or store to another memory-mapped I/O location.
These differences in behavior mainly affect the use of caches and write buffers in the memory system. This
is discussed in Chapter B5 Caches and Write Buffers. In short, memory-mapped I/O locations are normally
marked as uncachable and unbufferable, to avoid changes to the number, type, order, or timing of the
accesses made to them.
A2-31
Programmers Model
Successive loads from the same location without an intervening store generate identical results.
A load from a location returns the last value stored to that location.
Multiple accesses of one data size can sometimes be merged into a single, larger size access. For
example, separate stores to the two halfwords contained within a word can be merged to produce a
single word store.
However, if the memory words, halfwords or bytes accessed by the code sequence are memory-mapped I/O
locations, one access can generate a side-effect which changes the results of a subsequent access to a
different location. If this happens, the time order of individual accesses makes a difference to the final
results of the code sequence. Also, a load access to a memory-mapped I/O location can have a side-effect
that changes the result of a subsequent access to the same location. Accesses to memory-mapped I/O
locations must therefore not be optimized away, and their time order must not be changed.
It is also important that for memory-mapped I/O, the data size of each memory access is maintained. For
example, a code sequence that specifies 4 byte reads from 4 sequential byte addresses must not be merged
into a single word read when accessing memory-mapped I/O. Such a system might cause the final results of
the code sequence to be different from that intended. Similarly a system which splits word accesses up into
many byte accesses might cause memory-mapped I/O devices not to operate as expected.
Each ARM implementation provides a mechanism to ensure that no changes are made to the number of
accesses in a sequence of data memory accesses, or to their data sizes, or time order. This mechanism
consists of IMPLEMENTATION DEFINED requirements on the memory accesses whose number, data sizes, and
time order are to be preserved. If these requirements are not adhered to for accesses to memory-mapped I/O
locations, unexpected behavior might occur.
A2-32
Programmers Model
Constraints on memory attributes of the memory-mapped I/O locations. For example, in the standard
memory system architectures described in Part B: Memory and System Architectures, the memory
locations must be uncachable and unbufferable.
Constraints on the sizes or alignments of the accesses to the memory-mapped I/O locations. For
example, if an ARM implementation has a 16-bit external data bus, it might prohibit the use of 32-bit
accesses to memory-mapped I/O locations, since they cannot be performed in a single bus cycle.
A requirement for additional external hardware. For example, an alternative possibility for an ARM
implementation with a 16-bit external bus is to allow 32-bit accesses to memory-mapped I/O
locations, but require external hardware to re-assemble the two 16-bit bus accesses into a single
32-bit access to the I/O device.
If a sequence of data memory accesses includes some accesses which meet the requirements for
memory-mapped I/O accesses and some which do not, then:
The number and data sizes of the accesses that meet the requirements are preserved. In particular,
they are not merged with each other or with the accesses that do not meet the requirements in any
way. The accesses which do not meet the requirements can be merged with each other.
The time order of the accesses which meet the requirements are preserved relative to each other. Their
time order relative to accesses which do not meet the requirements is not guaranteed.
If the register list in the instruction includes the PC, the time order of the sequence of memory
accesses is not defined. (This means that such LDM and STM instructions are not suitable for accessing
memory-mapped I/O.)
If the register list in the instruction does not include the PC, the time order of the sequence of memory
accesses is in order of memory address, starting with the lowest address and ending with the highest
address. (This order is identical to ascending register number order within the list of registers to be
loaded or stored.)
If all of the memory accesses generated by an LDM or STM meet the IMPLEMENTATION DEFINED
requirements to be treated as memory-mapped I/O locations, then their number, data sizes and time
order are preserved.
A2-33
Programmers Model
If some of the memory accesses generated by an LDM or STM meet the IMPLEMENTATION DEFINED
requirements to be treated as memory-mapped I/O locations, but others do not, then their number,
data sizes and time order are not guaranteed to be preserved. In particular, the ARM processor and
memory system do not even necessarily preserve the relative time order of the accesses that do meet
the requirements. This is an exception to the normal rules that govern what happens when some
accesses meet the requirements and others do not.
For example, with the standard memory systems described in Part B: Memory and System
Architectures, the time order of the memory accesses is not guaranteed to be preserved if the LDM or
STM crosses the boundary between a cachable area of memory and an uncachable, unbufferable area.
Such LDM and STM instructions are therefore not suitable for memory-mapped I/O.
A2-34
Chapter A3
The ARM Instruction Set
This chapter describes the ARM instruction set and contains the following sections:
A3-1
3.1
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10
shift
cond [1]
0 0 0 1 0 x x 0
cond [1]
0 0 0
Miscellaneous instructions:
See Figure 3-3
cond [1]
0 0 0 1 0 x x 0
x x x x x x x x x x x x 0 x x 1
x x x x
cond [1]
0 0 0 x x
x x x x x x x x x x x x 1 x x 1
x x x x
cond [1]
0 0 1
cond [1]
0 0 1 1 0 x 0 0
cond [1]
0 0 1 1 0 R 1 0
Mask
cond [1]
0 1 0 P U B W L
Rn
Rd
cond [1]
0 1 1 P U B W L
Rn
Rd
Undefined instruction
cond [1]
0 1 1 x x
Load/store multiple
Undefined instruction [4]
Branch and branch with link
Branch and branch with link
and change to Thumb [4]
opcode
1 1 1 1 0 x x x x
cond [1]
Rn
Rn
Rd
Rs
Rd
rotate
SBO
Rm
immediate
rotate
immediate
immediate
shift amount
Rn
shift
Rm
x x x x x x x x x x x x x x x x x x x
1 1 1 1 1 0 1 H
24-bit offset
cond [5]
1 1 0 P U N W L
cond [5]
1 1 1 0
cond [5]
1 1 1 0 opcode1 L
Software interrupt
cond [1]
1 1 1 1
opcode1
x x x x
register list
24-bit offset
1 1 1 1 1 1 1 1 x
x x x x
x x x x x x x x x x x x x x x x x x x x
1 0 1 L
cond [1]
0 shift
x x x x x x x x x x x x x x x x x x x
x x x x x x x x x x x x x x x 0
Rm
x x x x x x x x x x x x x x x x x x 1 x x x x
1 0 0 P U S W L
1 1 1 1 1 0 0 x x
shift amount
0 0 0
x x x
Rd
cond [1]
Rn
Miscellaneous instructions:
See Figure 3-3
opcode
opcode
x x x x
Rn
CRd
cp_num
8-bit offset
CRn
CRd
cp_num
opcode2 0
CRm
CRn
Rd
cp_num
opcode2 1
CRm
swi number
x x x x x x x x x x x x x x x x x x x
x x x x
A3-2
1.
2.
3.
4.
5.
6.
7.
3.1.1
The cond field is not allowed to be 1111 in this line. Other lines deal with the cases where
bits[31:28] of the instruction are 1111.
If the opcode field is of the form 10xx and the S field is 0, one of the following lines applies instead.
UNPREDICTABLE prior to ARM architecture version 4.
UNPREDICTABLE prior to ARM architecture version 5.
If the cond field is 1111, this instruction is UNPREDICTABLE prior to ARM architecture version 5.
The coprocessor double register transfer instructions are described in Chapter A10 Enhanced DSP
Extension.
In E variants of architecture version 5 and above, the cache preload instruction PLD uses a small
number of these instruction encodings.
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10
Rd
Rn
Rs
1 0 0 1
Rm
RdHi
RdLo
Rs
1 0 0 1
Rm
Rn
Rd
SBZ
1 0 0 1
Rm
cond
0 0 0 P U 0 W L
Rn
Rd
SBZ
1 0 1 1
Rm
Load/store halfword
immediate offset [1]
cond
0 0 0 P U 1 W L
Rn
Rd
HiOffset
1 0 1 1
LoOffset
cond
0 0 0 P U 0 W 0
Rn
Rd
SBZ
1 1 S 1
Rm
cond
0 0 0 P U 0 W 1
Rn
Rd
SBZ
1 1 H 1
Rm
cond
0 0 0 P U 1 W 0
Rn
Rd
HiOffset
1 1 S 1
LoOffset
cond
0 0 0 P U 1 W 1
Rn
Rd
HiOffset
1 1 H 1
LoOffset
Multiply (accumulate)
cond
0 0 0 0 0 0
cond
0 0 0 0 1 U A S
Swap/swap byte
cond
0 0 0 1 0 B 0
Load/store halfword
register offset [1]
A S
UNPREDICTABLE prior
Note
Any instruction with bits[27:25] = 000, bit[7] = 1, bit[4] = 1, and cond not equal to 1111, and which is not
specified in Figure 3-2 or its notes, is an undefined instruction (or UNPREDICTABLE prior to ARM
architecture version 4).
A3-3
3.1.2
Miscellaneous instructions
Figure 3-3 shows the remaining ARM instruction encodings. An entry in square brackets, for example [1],
indicates that more information is given below the figure.
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10
cond
0 0 0 1 0 R 0 0
SBO
Rd
SBZ
0 0 0 0
SBZ
cond
0 0 0 1 0 R 1 0
mask
SBO
SBZ
0 0 0 0
Rm
cond
0 0 0 1 0 0 1 0
SBO
SBO
SBO
0 0 0 1
Rm
cond
0 0 0 1 0 1 1 0
SBO
Rd
SBO
0 0 0 1
Rm
cond
0 0 0 1 0 0 1 0
SBO
SBO
SBO
0 0 1 1
Rm
cond
0 0 0 1 0
Rn
Rd
SBZ
0 1 0 1
Rm
cond
0 0 0 1 0 0 1 0
0 1 1 1
immed
cond
0 0 0 1 0
1 y x 0
Rm
op
op
immed
Rd
Rn
Rs
Defined in ARM architecture version 5 and above, and in T variants of ARM architecture version 4.
This is an undefined instruction is ARM architecture version 4, and is UNPREDICTABLE prior to ARM
architecture version 4.
If the cond field of this instruction is not 1110, it is UNPREDICTABLE.
The enhanced DSP instructions are described in Chapter A10 Enhanced DSP Extension.
Note
Any instruction with bits[27:23] = 00010, bit[20] = 0, bit[7] and bit[4] not both 1, and cond is not equal to
1111, and which is not specified in Figure 3-3 or its notes, is an undefined instruction (or UNPREDICTABLE
prior to architecture version 4).
A3-4
3.2
28 27
cond
This field contains one of the 16 values described in Table 3-1 on page A3-6. Most instruction mnemonics
can be extended with the letters defined in the mnemonic extension field.
If the always (AL) condition is specified, the instruction is executed irrespective of the value of the
condition code flags. The absence of a condition code on an instruction mnemonic implies the AL condition
code.
3.2.1
Prior to ARM architecture version 3, a condition field of 0b1111 meant that the instruction was never
executed. The mnemonic extension for this condition was NV.
Note
Use of this condition is now obsolete and unsupported.
In ARM architecture version 3 and version 4, any instruction with a condition field of 0b1111 is
UNPREDICTABLE.
In ARM architecture version 5 and above, a condition field of 0b1111 is used to encode various
additional instructions which can only be executed unconditionally. All instruction encoding
diagrams which show bits[31:28] as cond only match instructions in which these bits are not equal
to 0b1111, unless otherwise stated in the individual instruction description.
A3-5
Mnemonic
extension
Meaning
0000
EQ
Equal
Z set
0001
NE
Not equal
Z clear
0010
CS/HS
C set
0011
CC/LO
C clear
0100
MI
Minus/negative
N set
0101
PL
Plus/positive or zero
N clear
0110
VS
Overflow
V set
0111
VC
No overflow
V clear
1000
HI
Unsigned higher
1001
LS
C clear or Z set
1010
GE
1011
LT
1100
GT
1101
LE
1110
AL
Always (unconditional)
1111
(NV)
A3-6
3.3
Branch instructions
All ARM processors support a branch instruction that allows a conditional branch forwards or backwards
up to 32MB. As the PC is one of the general-purpose registers (R15), a branch or jump can also be generated
by writing a value to R15.
A subroutine call can be performed by a variant of the standard branch instruction. As well as allowing a
branch forward or backward up to 32MB, the Branch with Link (BL) instruction preserves the address of
the instruction after the branch (the return address) in the LR (R14).
In T variants of ARM architecture version 4, and in ARM architecture version 5 and above, the Branch and
Exchange (BX) instruction copies the contents of a general-purpose register Rm to the PC (like a MOV
PC,Rm instruction), with the additional functionality that if bit[0] of the transferred value is 1, the processor
shifts to Thumb state. Together with the corresponding Thumb instructions, this allows interworking
branches between ARM and Thumb code.
Interworking subroutine calls can be generated by combining BX with an instruction to write a suitable
return address to the LR, such as an immediately preceding MOV LR,PC instruction.
In ARM architecture version 5 and above, there are also two types of Branch with Link and Exchange (BLX)
instruction:
One type takes a register operand Rm, like a BX instruction. This instruction behaves like a BX
instruction, and additionally writes the address of the next instruction into the LR. This provides a
more efficient interworking subroutine call than a sequence of MOV LR,PC followed by BX Rm.
The other type behaves like a BL instruction, branching backwards or forwards by up to 32MB and
writing a return link to the LR, but shifts to Thumb state rather than staying in ARM state as BL does.
This provides a more efficient alternative to loading the subroutine address into Rm followed by a
BLX Rm instruction when it is known that a Thumb subroutine is being called and that the subroutine
lies within the 32MB range.
A load instruction provides a way to branch anywhere in the 4GB address space (known as a long branch).
A 32-bit value is loaded directly from memory into the PC, causing a branch. A long branch can be preceded
by MOV LR,PC or another instruction that writes the LR to generate a long subroutine call. In ARM
architecture version 5 and above, bit[0] of the value loaded by a long branch controls whether the subroutine
is executed in ARM state or Thumb state, just like bit[0] of the value moved to the PC by a BX instruction.
Prior to ARM architecture version 5, bits[1:0] of the value loaded into the PC are ignored, and a load into
the PC can only be used to call a subroutine in ARM state.
In non-T variants of ARM architecture version 5, the instructions described above can cause an entry into
Thumb state despite the fact that the Thumb instruction set is not present. This causes the instruction at the
branch target to enter the undefined instruction trap. See The control bits on page A2-10 for more details.
A3-7
3.3.1
Examples
B
label
BCC
label
BEQ
label
MOV
PC, #0
BL
func
.
MOV
MOV
PC, LR
LR, PC
LDR
PC, =func
;
;
;
;
func
3.3.2
A3-8
.
R15=R14, return to instruction after the BL
store the address of the instruction
after the next one into R14 ready to return
load a 32-bit value into the program counter
BLX
Branch with Link and Exchange. See BLX (1) on page A4-16 and BLX (2) on page A4-18.
BX
3.4
Data-processing instructions
ARM has 16 data-processing instructions, shown in Table 3-2.
Table 3-2 Data-processing instructions
Opcode
Mnemonic
Operation
Action
0000
AND
Logical AND
Rd := Rn AND shifter_operand
0001
EOR
Logical Exclusive OR
Rd := Rn EOR shifter_operand
0010
SUB
Subtract
Rd := Rn - shifter_operand
0011
RSB
Reverse Subtract
Rd := shifter_operand - Rn
0100
ADD
Add
Rd := Rn + shifter_operand
0101
ADC
0110
SBC
0111
RSC
1000
TST
Test
1001
TEQ
Test Equivalence
1010
CMP
Compare
1011
CMN
Compare Negated
1100
ORR
Logical (inclusive) OR
Rd := Rn OR shifter_operand
1101
MOV
Move
1110
BIC
Bit Clear
Rd := Rn AND NOT(shifter_operand)
1111
MVN
Move Not
Most data-processing instructions take two source operands, though Move and Move Not take only one. The
compare and test instructions only update the condition flags. Other data-processing instructions store a
result to a register and optionally update the condition flags as well.
Of the two source operands, one is always a register. The other is called a shifter operand and is either an
immediate value or a register. If the second operand is a register value, it can have a shift applied to it.
CMP, CMN, TST and TEQ always update the condition code flags. The assembler automatically sets the S
bit in the instruction for them, and the corresponding instruction with the S bit clear is not a data-processing
instruction, but instead lies in one of the instruction extension spaces (see Extending the instruction set on
page A3-27). The remaining instructions update the flags if an S is appended to the instruction mnemonic
(which sets the S bit in the instruction). See The condition code flags on page A2-9 for more details.
A3-9
3.4.1
Instruction encoding
<opcode1>{<cond>}{S} <Rd>, <shifter_operand>
<opcode1> := MOV | MVN
<opcode2>{<cond>} <Rn>, <shifter_operand>
<opcode2> := CMP | CMN | TST | TEQ
<opcode3>{<cond>}{S} <Rd>, <Rn>, <shifter_operand>
<opcode3> := ADD | SUB | RSB | ADC | SBC | RSC | AND | BIC | EOR | ORR
31
28 27 26 25 24
cond
A3-10
0 0 I
21 20 19
opcode
16 15
Rn
12 11
Rd
shifter_operand
I bit
S bit
Rn
Rd
shifter_operand
3.4.2
ADD
AND
BIC
CMN
CMP
EOR
MOV
MVN
ORR
RSB
RSC
SBC
SUB
TEQ
TST
A3-11
3.5
Multiply instructions
ARM has two classes of Multiply instruction:
3.5.1
Normal multiply
There are two Multiply instructions that produce 32-bit results:
MUL
Multiplies the values of two registers together, truncates the result to 32 bits, and stores the
result in a third register.
MLA
Multiplies the values of two registers together, adds the value of a third register, truncates
the result to 32 bits, and stores the result in a fourth register. This can be used to perform
multiply-accumulate operations.
Both Multiply instructions can optionally set the N (Negative) and Z (Zero) condition code flags.
No distinction is made between signed and unsigned variants. Only the least significant 32 bits of the result
are stored in the destination register, and the sign of the operands does not affect this value.
3.5.2
Long multiply
There are four Multiply instructions that produce 64-bit results (long multiply).
Two of the variants multiply the values of two registers together and store the 64-bit result in third and fourth
registers. There are signed (SMULL) and unsigned (UMULL) variants. The signed variants produce a
different result in the most significant 32 bits if either or both of the source operands is negative.
The remaining two variants multiply the values of two registers together, add the 64-bit value from the third
and fourth registers and store the 64-bit result back into those registers (third and fourth). There are signed
(SMLAL) and unsigned (UMLAL) variants. These instructions perform a long multiply and accumulate.
All four long multiply instructions can optionally set the N (Negative) and Z (Zero) condition code flags.
3.5.3
A3-12
Examples
MUL
MULS
MLA
SMULL
R4,
R4,
R7,
R4,
R2,
R2,
R8,
R8,
R1
R1
R9, R3
R2, R3
UMULL
UMLAL
;
;
;
;
;
;
;
3.5.4
MUL
SMLAL
SMULL
UMLAL
UMULL
A3-13
3.6
3.6.1
To determine how many bits the operand should be shifted left in order to normalize it, so that its
most significant bit is 1. (This can be used in integer division routines.)
Instruction encoding
CLZ{<cond>}
31
28 27 26 25 24 23 22 21 20 19
cond
Rd
Rm
3.6.2
<Rd>, <Rm>
0 0 0 1 0 1 1 0
16 15
SBO
12 11
Rd
SBO
4 3
0 0 0 1
Rm
A3-14
3.7
Bits[23:16]
Bits[15:8]
Bits[7:0]
To date, the ARM architecture does not use the status and extension fields, and three bits are unused in the
flags field. The four condition code flags occupy bits[31:28]. In E variants of architecture versions 5 and
above, the Q flag occupies bit[27]. See The Q flag on page A10-5 for more information on the Q flag. The
control field contains two interrupt disable bits, five processor mode bits, and the Thumb bit on ARM
architecture version 5 and above and on T variants of ARM architecture version 4 (see The T bit on
page A2-11).
The unused bits of the status registers might be used in future ARM architectures, and must not be modified
by software. Therefore, a read-modify-write strategy must be used to update the value of a status register to
ensure future compatibility.
The status registers are readable to allow the read part of the read-modify-write operation, and to allow all
processor state to be preserved (for instance, during process context switches).
The status registers are writable to allow the write part of the read-modify-write operation, and allow all
processor state to be restored.
3.7.1
CPSR value
Altering the value of the CPSR has three uses:
sets the value of the condition code flags (and of the Q flag when it exists) to a known value
Note
The T bit must not be changed directly by writing to the CPSR, but only via the BX instruction, and in the
implicit SPSR to CPSR moves in instructions designed for exception return. Attempts to enter or leave
Thumb state by directly altering the T bit can have UNPREDICTABLE consequences.
A3-15
3.7.2
Examples
These examples assume that the ARM processor is already in a privileged mode. If the ARM processor
starts in User mode, only the flag update has any effect.
3.7.3
A3-16
MRS
BIC
MSR
R0, CPSR
R0, R0, #0xF0000000
CPSR_f, R0
;
;
;
;
MRS
ORR
MSR
R0, CPSR
R0, R0, #0x80
CPSR_c, R0
;
;
;
;
MRS
BIC
ORR
MSR
R0, CPSR
R0, R0, #0x1F
R0, R0, #0x11
CPSR_c, R0
;
;
;
;
;
MSR
3.8
3.8.1
The first type can load or store a 32-bit word or an 8-bit unsigned byte.
The second type can load or store a 16-bit unsigned halfword, and can load and sign extend a 16-bit
halfword or an 8-bit byte. This type of instruction is only available in ARM architecture version 4
and above.
Addressing modes
In both types of instruction, the addressing mode is formed from two parts:
the offset.
The base register can be any one of the general-purpose registers (including the PC, which allows
PC-relative addressing for position-independent code).
The offset takes one of three formats:
Immediate
The offset is an unsigned number that can be added to or subtracted from the base
register. Immediate offset addressing is useful for accessing data elements that are
a fixed distance from the start of the data object, such as structure fields, stack
offsets and input/output registers.
For the word and unsigned byte instructions, the immediate offset is a 12-bit
number. For the halfword and signed byte instructions, it is an 8-bit number.
Register
The offset is a general-purpose register (not the PC), that can be added to or
subtracted from the base register. Register offsets are useful for accessing arrays or
blocks of data.
Scaled register
The offset is a general-purpose register (not the PC) shifted by an immediate value,
then added to or subtracted from the base register. The same shift operations used
for data-processing instructions can be used (Logical Shift Left, Logical Shift Right,
Arithmetic Shift Right and Rotate Right), but Logical Shift Left is the most useful
as it allows an array indexed to be scaled by the size of each array element.
Scaled register offsets are only available for the word and unsigned byte
instructions.
As well as the three types of offset, the offset and base register are used in three different ways to form the
memory address. The addressing modes are described as follows:
Offset
The base register and offset are added or subtracted to form the memory address.
Pre-indexed
The base register and offset are added or subtracted to form the memory address.
The base register is then updated with this new address, to allow automatic indexing
through an array or memory block.
A3-17
Post-indexed
3.8.2
The value of the base register alone is used as the memory address. The base register
and offset are added or subtracted and this value is stored back in the base register,
to allow automatic indexing through an array or memory block.
28 27 26 25 24 23 22 21 20 19
cond
3.8.3
0 1 I P U B W L
16 15
Rn
12 11
Rd
addressing_mode_specific
I, P, U, W
L bit
B bit
Rn
Rd
28 27 26 25 24 23 22 21 20 19
cond
A3-18
Rd, <addressing_mode>
0 0 0 P U I W L
16 15
Rn
12 11
Rd
4 3
addr_mode 1 S H 1 addr_mode
addr_mode
I, P, U, W
Are bits that specify the type of addressing mode (see Addressing Mode 3 - Miscellaneous
Loads and Stores on page A5-34).
L bit
S bit
Distinguishes between a signed (S==1) and an unsigned (S==0) halfword access. If the L
bit is zero and S bit is one, the instruction is UNPREDICTABLE.
3.8.4
H bit
Distinguishes between a halfword (H==1) and a signed byte (H==0) access. If the S bit and
H bit are both zero, this instruction encodes a SWP or Multiply instruction.
Rn
Rd
Examples
LDR
LDR
LDR
STR
R1, [R0]
R8, [R3, #4]
R12, [R13, #-4]
R2, [R1, #0x100]
;
;
;
;
LDRB
R5, [R9]
LDRB
STRB
LDR
STRB
LDR
LDR
STRB
LDR
STR
R3, [R9], #4
R2, [R5], #8
LDR
LDR
R0, [R1], R2
LDRH
R1, [R0]
LDRH
LDRH
STRH
;
;
;
;
;
LDRSH
LDRSB
LDRSB
R5, [R9]
R3, [R8, #3]
R4, [R10, #0xC1]
LDRH
STRH
LDRSH
A3-19
3.8.5
A3-20
LDRSB
LDRH
R3, [R9], #2
STRH
R2, [R5], #8
LDRB
LDRBT
Load Byte with User Mode Privilege. See LDRBT on page A4-42.
LDRH
LDRSB
LDRSH
LDRT
Load Word with User Mode Privilege. See LDRT on page A4-50.
STR
STRB
STRBT
Store Byte with User Mode Privilege. See STRBT on page A4-92.
STRH
STRT
Store Word with User Mode Privilege. See STRT on page A4-96.
3.9
Rn{!}, <registers>{^}
Rn{!}, <registers>{^}
where:
<addressing_mode> = IA | IB | DA | DB | FD | FA | ED | EA
31
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 P U S W L
register list
16 15
Rn
register list
The list of <registers> has one bit for each general-purpose register. Bit 0 is for
R0, and bit 15 is for R15 (the PC).
The register syntax list is an opening bracket, followed by a comma-separated list
of registers, followed by a closing bracket. A sequence of consecutive registers can
be specified by separating the first and last registers in the range with a minus sign.
3.9.1
P, U, and W bits
These distinguish between the different types of addressing mode (see Addressing
Mode 4 - Load and Store Multiple on page A5-48).
S bit
For LDMs that load the PC, the S bit indicates that the CPSR is loaded from the SPSR
after all the registers have been loaded. For all STMs, and LDMs that do not load the
PC, it indicates that when the processor is in a privileged mode, the User mode
banked registers are transferred and not the registers of the current mode.
L bit
Rn
Examples
STMFD
LDMFD
LDMIA
STMDA
R13!, {R0
R13!, {R0
R0, {R5 R1!, {R2,
- R12, LR}
- R12, PC}
R8}
R5, R7 - R9, R11}
A3-21
3.9.2
A3-22
LDM
LDM
Load Multiple with Restore CPSR. See LDM (3) on page A4-34.
STM
STM
3.10
Semaphore instructions
The ARM instruction set has two semaphore instructions:
Swap (SWP)
3.10.1
3.10.2
Examples
SWP
SWPB
SWP
SWPB
A3-23
3.11
Exception-generating instructions
The ARM instruction set provides two types of instruction whose main purpose is to cause a processor
exception to occur:
The Software Interrupt (SWI) instruction is used to cause a SWI exception to occur (see Software
Interrupt exception on page A2-16). This is the main mechanism in the ARM instruction set by which
User mode code can make calls to privileged Operating System code.
The Breakpoint (BKPT) instruction is used for software breakpoints in ARM architecture versions 5
and above. Its default behavior is to cause a Prefetch Abort exception to occur (see Prefetch Abort
(instruction fetch memory abort) on page A2-16). A debug monitor program which has previously
been installed on the Prefetch Abort vector can handle this exception.
If debug hardware is present in the system, it is allowed to override this default behavior. Details of
whether and how this happens are IMPLEMENTATION DEFINED.
3.11.1
Instruction encodings
SWI{<cond>}
31
<immed_24>
28 27 26 25 24 23
cond
BKPT
31
1 1 1 1
immed_24
<immediate>
28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 0 0 1 0
immed
4 3
0 1 1 1
immed
In both SWI and BKPT, the immediate fields of the instruction are ignored by the ARM processor. The SWI
or Prefetch Abort handler can optionally be written to load the instruction that caused the exception and
extract these fields. This allows them to be used to communicate extra information about the Operating
System call or breakpoint to the handler.
3.11.2
A3-24
SWI
3.12
Coprocessor instructions
The ARM instruction set provides three types of instruction for communicating with coprocessors. These
allow:
the ARM processor to generate addresses for the coprocessor Load and Store instructions.
The instruction set distinguishes up to 16 coprocessors with a 4-bit field in each coprocessor instruction, so
each coprocessor is assigned a particular number.
Note
One coprocessor can use more than one of the 16 numbers if a large coprocessor instruction set is required.
Coprocessors execute the same instruction stream as ARM, ignoring ARM instructions and coprocessor
instructions for other coprocessors. Coprocessor instructions that cannot be executed by coprocessor
hardware cause an undefined instruction trap, allowing software emulation of coprocessor hardware.
A coprocessor can partially execute an instruction and then cause an exception. This is useful for handling
run-time-generated exceptions, like divide-by-zero or overflow. However, the partial execution is internal
to the coprocessor and is not visible to the ARM processor. As far as the ARM processor is concerned, the
instruction is held at the start of its execution and completes without exception if allowed to begin execution.
Any decision on whether to execute the instruction or cause an exception is taken within the coprocessor
before the ARM processor is allowed to start executing the instruction.
Not all fields in coprocessor instructions are used by the ARM processor. Coprocessor register specifiers
and opcodes are defined by individual coprocessors. Therefore, only generic instruction mnemonics are
provided for coprocessor instructions. Assembler macros can be used to transform custom coprocessor
mnemonics into these generic mnemonics, or to regenerate the opcodes manually.
3.12.1
Examples
CDP
;
;
;
;
MRC
;
;
;
;
MCR
;
;
;
;
A3-25
3.12.2
LDC
LDC
STC
;
;
;
;
STC
;
;
;
;
LDC
MCR
MRC
STC
Note
Coprocessor instructions are not implemented in ARM architecture version 1.
A3-26
3.13
2.
If the decode bits of an instruction are equal to those of a defined instruction, but the whole instruction
is not a defined instruction, then the instruction is UNPREDICTABLE.
For example, suppose an instruction has:
3.
In ARM architecture version 4 and above, if the decode bits of an instruction are not equal to those
of any defined instruction, then the instruction is UNDEFINED.
4.
In ARM architecture version 3 and below, if the decode bits of an instruction are not equal to those
of any defined instruction, then the instruction is:
Each of rules 2 to 4 above applies separately to each ARM architecture version. As a result, the status of an
instruction might differ between architecture versions. Usually, this happens because an instruction which
was UNPREDICTABLE or UNDEFINED in an earlier architecture version becomes a defined instruction in a later
version.
ARM DDI 0100E
A3-27
3.13.1
28 27 26 25 24
cond
4 3
0 1 1 x x x x x x x x x x x x x x x x x x x x 1 x x x x
The meaning of instructions in the undefined instruction space is UNDEFINED on all versions of the ARM
architecture.
In general, undefined instructions might be used to extend the ARM instruction set in the future. However,
it is intended that instructions with the following encoding will not be used for this:
31
28 27 26 25 24 23 22 21 20 19
cond
4 3
0 1 1 1 1 1 1 1 x x x x x x x x x x x x 1 1 1 1 x x x x
If a programmer wants to use an undefined instruction for software purposes, with minimal risk that future
hardware will treat it as a defined instruction, one of the instructions with this encoding must be used.
A3-28
3.13.2
== 0b0000
== 0b1001
!= 0b1111
28 27 26 25 24 23
cond
0 0 0 0
20 19
op1
16 15
Rn
12 11
Rd
Rs
6 5
1 0 0 1
Rm
Table 3-3 summarizes the instructions that have already been allocated in this area.
Table 3-3 Arithmetic instruction space
Instructions
op1
Architecture versions
MUL, MULS
000S
MLA, MLAS
001S
UMULL, UMULLS
100S
All M variants
UMLAL, UMLALS
101S
All M variants
SMULL, SMULLS
110S
All M variants
SMLAL, SMLALS
111S
All M variants
A3-29
3.13.3
==
==
==
!=
0b00
0b10
0
0b1111
and not:
opcode[25] == 0
opcode[7] == 1
opcode[4] == 1
The field names given are guidelines suggested to simplify implementation.
31
28 27 26 25 24 23 22 21 20 19
16 15
12 11
cond
0 0 0 1 0
op1
Rn
Rd
Rs
cond
0 0 0 1 0
op1
Rn
Rd
Rs
cond
0 0 1 1 0
op1
Rn
Rd
rotate_imm
op2
0
op2
4 3
Rm
Rm
immed_8
Table 3-4 summarizes the instructions that have already been allocated in this area.
Table 3-4 Control extension space instructions
A3-30
Instruction
Bit[25]
Bits[7:4]
op1
Architecture versions
MRS
0000
x0
0000
x1
BX
0001
01
CLZ
0001
11
0011
01
QADD
0101
00
QSUB
0101
01
QDADD
0101
10
QDSUB
0101
11
Bit[25]
Bits[7:4]
op1
Architecture versions
BKPT
0111
01
SMLA<x><y>
1yx0
00
SMLAW<y>
1y00
01
SMULW<y>
1y10
01
SMLAL<x><y>
1yx0
10
SMUL<x><y>
1yx0
11
xxxx
x1
A3-31
3.13.4
==
==
==
!=
0b000
1
1
0b1111 /* Only required for version 5 and above */
and not:
opcode[24] == 0
opcode[6:5] == 0
The field names given are guidelines suggested to simplify implementation.
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U B W L
16 15
Rn
12 11
Rd
Rs
op1
4 3
Rm
Table 3-5 summarizes the instructions that have already been allocated in this area.
Table 3-5 Load/store instructions
A3-32
Instruction
Bits[24:20]
op1
Architecture versions
SWP/SWPB
STRH
LDRD
STRD
LDRH
LDRSB
LDRSH
3.13.5
== 0b11000
== 0
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 0 0 x 0 x
16 15
Rn
12 11
CRd
cp_num
offset
In ARM architecture version 3 and below, all instructions in the coprocessor instruction extension space are
UNPREDICTABLE.
In all variants of architecture version 4, and in non-E variants of architecture 5, all instructions in the
coprocessor instruction extension space are UNDEFINED. It is IMPLEMENTATION DEFINED how an ARM
processor achieves this. The options are:
The ARM processor might take the undefined instruction trap directly.
The ARM processor might require attached coprocessors not to respond to such instructions. This
causes the undefined instruction trap to be taken (see Undefined Instruction exception on
page A2-15).
In E variants of architecture version 5, instructions in the coprocessor instruction extension space are treated
as follows:
Instructions with bit[22] == 0 are UNDEFINED and are handled in precisely the same way as described
above for non-E variants.
Instructions with bit[22] ==1 are the MCRR and MRRC instructions described in Chapter A10
Enhanced DSP Extension.
A3-33
3.13.6
20 19
1 1 1 1
opcode1
x x x x x x x x x x x x
4 3
opcode2
x x x x
Table 3-6 summarizes the instructions that have already been allocated in this area.
Table 3-6 Unconditional instruction extension space
A3-34
Instruction
opcode1
opcode2
Architecture versions
PLD
BLX
(address form)
STC2
LDC2
CDP2
MCR2
MRC2
Chapter A4
ARM Instructions
This chapter describes the syntax and usage of every ARM instruction, in the sections:
A4-1
ARM Instructions
4.1
4.1.1
General notes
These notes explain the types of information and abbreviations used on the instruction pages.
Syntax abbreviations
The following abbreviations are used in the instruction pages:
immed_n
This is an immediate value, where n is the number of bits. For example, an 8-bit immediate
value is represented by:
immed_8
offset_n
This is an offset value, where n is the number of bits. For example, an 8-bit offset value is
represented by:
offset_8
The same construction is used for signed offsets. For example, an 8-bit signed offset is
represented by:
signed_offset_8
Architecture versions
This gives details of architecture versions where the instruction is valid. For details, see Architecture
versions and variants on page Preface-v.
Exceptions
This gives details of which exceptions can occur during the execution of the instruction. Prefetch Abort is
not listed in general, both because it can occur for any instruction and because if an abort occurred during
instruction fetch, the instruction bit pattern is not known. (Prefetch Abort is however listed for BKPT, since
it can generate a Prefetch Abort exception without these considerations applying.)
A4-2
ARM Instructions
Operation
This gives a pseudo-code description of what the instruction does. For details of conventions used in this
pseudo-code, see Pseudo-code descriptions of instructions on page Preface-xii.
Information on usage
Usage sections are included where appropriate to supply suggestions and other information about how to
use the instruction effectively.
A4-3
ARM Instructions
4.1.2
ADC
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 1 0 1 S
16 15
Rn
12 11
Rd
shifter_operand
The ADC (Add with Carry) instruction adds the value of <shifter_operand> and the Carry flag to the
value of <Rn> and stores the result in <Rd>. The condition code flags are optionally updated, based on the
result.
Syntax
ADC{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the
instruction. Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the addition,
and the C and V flags are set according to whether the addition generated a carry
(unsigned overflow) and a signed overflow, respectively. The rest of the CPSR is
unchanged.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the addition.
<shifter_operand>
Specifies the second operand for the addition. The options for this operand are described in
Addressing Mode 1 - Data-processing operands on page A5-2, including how each option
causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not ADC.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-4
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn + shifter_operand + C Flag
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = CarryFrom(Rn + shifter_operand + C Flag)
V Flag = OverflowFrom(Rn + shifter_operand + C Flag)
Usage
ADC is used to synthesize multi-word addition. If register pairs R0, R1 and R2, R3 hold 64-bit values (where
R0 and R2 hold the least significant words) the following instructions leave the 64-bit sum in R4, R5:
ADDS R4,R0,R2
ADC R5,R1,R3
R5,R1,R3
to:
ADCS R5,R1,R3
The following instruction produces a single-bit Rotate Left with Extend operation (33-bit rotate through the
Carry flag) on R0:
ADCS R0,R0,R0
See Data-processing operands - Rotate right with extend on page A5-17 for information on how to perform
a similar rotation to the right.
A4-5
ARM Instructions
4.1.3
ADD
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 1 0 0 S
16 15
Rn
12 11
Rd
shifter operand
The ADD instruction adds the value of <shifter_operand> to the value of register <Rn>, and stores
the result in the destination register <Rd>. The condition code flags are optionally updated, based on the
result.
Syntax
ADD{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The condition field on page A3-5.
If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the
instruction. Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the addition,
and the C and V flags are set according to whether the addition generated a carry
(unsigned overflow) and a signed overflow, respectively. The rest of the CPSR is
unchanged.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the addition.
<shifter_operand>
Specifies the second operand for the addition. The options for this operand are described in
Addressing Mode 1 - Data-processing operands on page A5-2, including how each option
causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not ADD.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-6
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn + shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = CarryFrom(Rn + shifter_operand)
V Flag = OverflowFrom(Rn + shifter_operand)
Usage
The ADD instruction is used to add two values together to produce a third.
To increment a register value in Rx use:
ADD Rx, Rx, #1
where the offset must be the difference between the required address and the address held in the PC, where
the PC is the address of the ADD instruction itself plus 8 bytes.
A4-7
ARM Instructions
4.1.4
AND
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 0 0 0 S
16 15
Rn
12 11
Rd
shifter_operand
The AND instruction performs a bitwise AND of the value of register <Rn> with the value of
<shifter_operand>, and stores the result in the destination register <Rd>. The condition code flags
are optionally updated, based on the result.
Syntax
AND{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the
instruction. Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the operation,
and the C flag is set to the carry output bit generated by the shifter (see Addressing
Mode 1 - Data-processing operands on page A5-2). The V flag and the rest of the
CPSR are unaffected.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the operation.
<shifter_operand>
Specifies the second operand for the operation. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not AND.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-8
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn AND shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
Usage
AND is most useful for extracting a field from a register, by ANDing the register with a mask value that has
1s in the field to be extracted, and 0s elsewhere.
A4-9
ARM Instructions
4.1.5
B, BL
31
28 27 26 25 24 23
cond
1 0 1 L
signed_immed_24
The B (Branch) and BL (Branch and Link) instructions cause a branch to a target address, and provide both
conditional and unconditional changes to program flow.
Syntax
B{L}{<cond>}
<target_address>
where:
L
Causes the L bit (bit 24) in the instruction to be set to 1. The resulting instruction stores a
return address in the link register (R14). If L is omitted, the L bit is 0 and the instruction
simply branches without storing a return address.
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<target_address>
Specifies the address to branch to. The branch target address is calculated by:
1.
2.
3.
Adding this to the contents of the PC, which contains the address of the branch
instruction plus 8.
Architecture version
All
Exceptions
None
Operation
if ConditionPassed(cond) then
if L == 1 then
LR = address of the instruction after the branch instruction
PC = PC + (SignExtend(signed_immed_24) << 2)
A4-10
ARM Instructions
Usage
The BL instruction is used to perform a subroutine call. The return from subroutine is achieved by copying
the LR to the PC. Typically, this is done by one of the following methods:
Storing a group of registers and R14 to the stack on subroutine entry, using an instruction of the form:
STMFD R13!,{<registers>,R14}
and then restoring the register values and returning with an instruction of the form:
LDMFD R13!,{<registers>,PC}
To calculate the correct value of signed_immed_24, the assembler (or other toolkit component) needs to:
1.
Form the base address for this branch instruction. This is the address of the instruction, plus 8. In
other words, this base address is equal to the PC value used by the instruction.
2.
Subtract the base address from the target address to form a byte offset. This offset is always a multiple
of four, because all ARM instructions are word-aligned.
3.
If the byte offset is outside the range 33554432 to +33554428, use an alternative code-generation
strategy or produce an error as appropriate.
4.
Otherwise, set the signed_immed_24 field of the instruction to bits{25:2] of the byte offset.
Notes
Memory bounds
Branching backwards past location zero and forwards over the end of the 32-bit
address space is UNPREDICTABLE.
A4-11
ARM Instructions
4.1.6
BIC
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 1 1 0 S
16 15
Rn
12 11
Rd
shifter_operand
The BIC (Bit Clear) instruction performs a bitwise AND of the value of register <Rn> with the complement
of the value of <shifter_operand>, and stores the result in the destination register <Rd>. The
condition code flags are optionally updated, based on the result.
Syntax
BIC{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the
instruction. Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the operation,
and the C flag is set to the carry output bit generated by the shifter (see Addressing
Mode 1 - Data-processing operands on page A5-2). The V flag and the rest of the
CPSR are unaffected.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the operation.
<shifter_operand>
Specifies the second operand for the operation. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not BIC.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-12
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn AND NOT shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
Usage
BIC can be used to clear selected bits in a register. For each bit, BIC with 1 clears the bit, and BIC with 0
leaves it unchanged.
A4-13
ARM Instructions
4.1.7
BKPT
31
28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 0 0 1 0
immed
4 3
0 1 1 1
immed
The BKPT (Breakpoint) instruction causes a software breakpoint to occur. This breakpoint can be handled
by an exception handler installed on the prefetch abort vector. In implementations which also include debug
hardware, the hardware can optionally override this behavior and handle the breakpoint itself. When this
occurs, the prefetch abort vector is not entered.
Syntax
BKPT
<immediate>
where:
<immediate>
Is a 16-bit immediate value, the top 12 bits of which are placed in bits[19:8] of the
instruction, and the bottom 4 bits of which are placed in bits[3:0] of the instruction.
This value is ignored by the ARM hardware, but can be used by a debugger to store
additional information about the breakpoint.
Architecture version
Version 5 and above
Exceptions
Prefetch Abort
Operation
if (not overridden by debug hardware)
R14_abt
= address of BKPT instruction + 4
SPSR_abt = CPSR
CPSR[4:0] = 0b10111
/* Enter Abort mode */
CPSR[5]
= 0
/* Execute in ARM state */
/* CPSR[6] is unchanged */
CPSR[7]
= 1
/* Disable normal interrupts */
if high vectors configured then
PC
= 0xFFFF000C
else
PC
= 0x0000000C
A4-14
ARM Instructions
Usage
The exact usage of the BKPT instruction depends on the debug system being used. A debug system can use
the BKPT instruction in two ways:
Debug hardware, if present, does not override the normal behavior of the BKPT instruction, and so
the prefetch abort vector is entered. If the system also allows real prefetch aborts to occur, the
prefetch abort handler determines, in a system-dependent manner, whether the vector entry occurred
as a result of a BKPT instruction or as a result of a real prefetch abort, and branches to debug code or
prefetch abort code accordingly. Otherwise, the prefetch abort handler just branches straight to debug
code.
When used in this manner, the BKPT instruction must be avoided within abort handlers, as it corrupts
R14_abt and SPSR_abt. For the same reason, it must also be avoided within FIQ handlers, since an
FIQ interrupt can occur within an abort handler.
Debug hardware does override the normal behavior of the BKPT instruction and handles the software
breakpoint itself. When finished, it typically either resumes execution at the instruction following the
BKPT, or replaces the BKPT in memory with another instruction and resumes execution at that
instruction.
When BKPT is used in this manner, R14_abt and SPSR_abt are not corrupted, and so the above
restrictions about its use in abort and FIQ handlers do not apply.
Notes
Condition field
Hardware override
A4-15
ARM Instructions
4.1.8
BLX (1)
31 30 29 28 27 26 25 24 23
1 1 1 1 1 0 1 H
signed_immed_24
This form of the BLX (Branch with Link and Exchange) instruction is used to call a Thumb subroutine from
the ARM instruction set at an address specified in the instruction. This instruction is unconditional (always
causing a change in program flow) and preserves the address of the instruction following the branch in the
link register (R14). Execution of Thumb instructions begins at the target address.
Syntax
BLX
<target_addr>
where:
<target_addr>
Specifies the address of the Thumb instruction to branch to. The branch target
address is calculated by:
1.
2.
3.
4.
Architecture version
Version 5 and above
Exceptions
None
Operation
LR = address of the instruction after the BLX instruction
T Flag = 1
PC = PC + (SignExtend(signed_immed_24) << 2) + (H << 1)
A4-16
ARM Instructions
Usage
To return from a Thumb subroutine called via BLX to the ARM caller, use the Thumb instruction:
BX
R14
{<registers>,PC}
To calculate the correct value of signed_immed_24, the assembler (or other toolkit component) needs to:
1.
Form the base address for this branch instruction. This is the address of the instruction, plus 8. In
other words, this base address is equal to the PC value used by the instruction.
2.
Subtract the base address from the target address to form a byte offset. This offset is always even,
because all ARM instructions are word-aligned and all Thumb instructions are halfword-aligned.
3.
If the byte offset is outside the range 33554432 to +33554430, use an alternative code-generation
strategy or produce an error as appropriate.
4.
Otherwise, set the signed_immed_24 field of the instruction to bits{25:2] of the byte offset, and the
H bit of the instruction to bit[1] of the byte offset.
Notes
Condition
Unlike most other ARM instructions, this instruction cannot be executed conditionally.
Bit[24]
A4-17
ARM Instructions
4.1.9
BLX (2)
31 30 29 28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 1 0
16 15
SBO
12 11
SBO
SBO
4 3
0 0 1 1
Rm
This form of BLX is used to call an ARM or Thumb subroutine from the ARM instruction set, at an address
specified in a register. The branch target address is the value of register Rm, with its bit[0] forced to zero.
The instruction set to be used at the branch target is chosen by setting the CPSR T bit to bit[0] of Rm.
Register 14 is set to a return address. To return from the subroutine, use a BX R14 instruction, or store R14
on the stack and re-load the stored value into the PC.
Syntax
BLX{<cond>}
where:
<cond>
<Rm>
<Rm>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Is the register containing the address of the target instruction. Bit[0] of Rm is 0 to select a
target ARM instruction, or 1 to select a target Thumb instruction. If R15 is specified for
<Rm>, the results are UNPREDICTABLE.
Architecture version
Version 5 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
LR = address of instruction after the BLX instruction
T Flag = Rm[0]
PC = Rm AND 0xFFFFFFFE
Notes
ARM/Thumb state transfers
If Rm[1:0] == 0b10, the result is UNPREDICTABLE, as branches to non word-aligned
addresses are impossible in ARM state.
A4-18
ARM Instructions
4.1.10
BX
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 1 0
16 15
SBO
12 11
SBO
SBO
6 5
0 0 0 1
Rm
The BX (Branch and Exchange) instruction branches to an address held in a register Rm, with an optional
switch to Thumb execution. The branch target address is the value of register Rm, with its bit[0] forced to
zero. The instruction set to be used at the branch target is chosen by setting the CPSR T bit to bit[0] of Rm.
Syntax
BX{<cond>}
where:
<cond>
<Rm>
<Rm>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Holds the value of the branch target address. Bit[0] of Rm is 0 to select a target ARM
instruction, or 1 to select a target Thumb instruction.
Architecture version
Version 5 and above, plus T variants of version 4
Exceptions
None
Operation
if ConditionPassed(cond) then
T Flag = Rm[0]
PC = Rm AND 0xFFFFFFFE
Notes
ARM/Thumb state transfers
If Rm[1:0] == 0b10, the result is UNPREDICTABLE, as branches to non word-aligned
addresses are impossible in ARM state.
Use of R15
A4-19
ARM Instructions
4.1.11
CDP
31
28 27 26 25 24 23
cond
1 1 1 0
20 19
opcode_1
16 15
CRn
12 11
CRd
cp_num
4 3
opcode_2 0
CRm
The CDP (Coprocessor Data Processing) instruction tells the coprocessor whose number is cp_num to
perform an operation that is independent of ARM registers and memory. If no coprocessors indicate that
they can execute the instruction, an Undefined Instruction exception is generated.
Syntax
CDP{<cond>}
CDP2
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined
in The condition field on page A3-5. If <cond> is omitted, the AL (always)
condition is used.
CDP2
Causes the condition field of the instruction to be set to 0b1111. This provides
additional opcode space for coprocessor designers. The resulting instructions can
only be executed unconditionally.
<coproc>
Specifies the name of the coprocessor, and causes the corresponding coprocessor
number to be placed in the cp_num field of the instruction. The standard generic
coprocessor names are p0, p1, ..., p15.
<opcode_1>
<CRd>
<CRn>
Specifies the coprocessor register that contains the first operand for the instruction.
<CRm>
Specifies the coprocessor register that contains the second operand for the
instruction.
<opcode_2>
Architecture version
CDP is in Version 2 and above.
CDP2 is in Version 5 and above.
Exceptions
Undefined Instruction
A4-20
ARM Instructions
Operation
if ConditionPassed(cond) then
Coprocessor[cp_num]-dependent operation
Usage
CDP is used to initiate coprocessor instructions that do not operate on values in ARM registers or in main
memory. An example is a floating-point multiply instruction for a floating-point coprocessor.
Notes
Coprocessor fields
Only instruction bits[31:24], bits[11:8], and bit[4] are architecturally defined. The
remaining fields are recommendations, for compatibility with ARM Development
Systems.
A4-21
ARM Instructions
4.1.12
CLZ
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 1 1 0
16 15
SBO
12 11
Rd
SBO
4 3
0 0 0 1
Rm
The CLZ (Count Leading Zeros) instruction returns the number of binary zero bits before the first binary
one bit in a register value. The source register is scanned from the most significant bit (bit[31]) towards the
least significant bit (bit[0]). The result value is 32 if no bits are set in the source register, and zero if bit[31]
is set.
This instruction does not update the condition code flags.
Syntax
CLZ{<cond>}
where:
<cond>
<Rd>, <Rm>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Specifies the destination register for the operation. If R15 is specified for <Rd>, the result
is UNPREDICTABLE.
Specifies the source register for this operation. If R15 is specified for <Rm>, the result is
UNPREDICTABLE.
<Rd>
<Rm>
Architecture version
Version 5 and above
Exceptions
None
Operation
if Rm == 0
Rd = 32
else
Rd = 31 - (bit position of most significant 1 in Rm)
Usage
To normalize the value of register Rm, use CLZ followed by a left shift of Rm by the resulting Rd value. This
shifts Rm so that its most significant 1 bit is in bit[31]. Using MOVS rather than MOV sets the Z flag in the
special case that Rm is zero and so does not have a most significant 1 bit:
CLZ
MOVS
A4-22
Rd, Rm
Rm, Rm, LSL Rd
ARM Instructions
4.1.13
CMN
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 0 1 1 1
16 15
Rn
12 11
SBZ
shifter_operand
The CMN (Compare Negative) instruction compares a register value with the negative of another arithmetic
value. The condition flags are updated, based on the result of adding the second arithmetic value to the
register value, so that subsequent instructions can be conditionally executed.
Syntax
CMN{<cond>}
<Rn>, <shifter_operand>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rn>
Specifies the register that contains the first operand for the operation.
<shifter_operand>
Specifies the second operand for the operation. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not CMN.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
Exceptions
None
Operation
if ConditionPassed(cond) then
alu_out = Rn + shifter_operand
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = CarryFrom(Rn + shifter_operand)
V Flag = OverflowFrom(Rn + shifter_operand)
A4-23
ARM Instructions
Usage
CMN performs a comparison by adding the value of <shifter_operand> to the value of register <Rn>,
and updates the condition code flags (based on the result). This is almost equivalent to subtracting the
negative of the second operand from the first operand, and setting the flags on the result.
The difference is that the flag values generated can differ when the second operand is 0 or 0x80000000.
For example, this instruction always leaves the C flag = 1:
CMP Rn, #0
A4-24
ARM Instructions
4.1.14
CMP
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 0 1 0 1
16 15
Rn
12 11
SBZ
shifter_operand
The CMP (Compare) instruction compares a register value with another arithmetic value. The condition flags
are updated, based on the result of subtracting the second arithmetic value from the register value, so that
subsequent instructions can be conditionally executed.
Syntax
CMP{<cond>}
<Rn>, <shifter_operand>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rn>
Specifies the register that contains the first operand for the operation.
<shifter_operand>
Specifies the second operand for the operation. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not CMP.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
Exceptions
None
Operation
if ConditionPassed(cond) then
alu_out = Rn - shifter_operand
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - shifter_operand)
V Flag = OverflowFrom(Rn - shifter_operand)
A4-25
ARM Instructions
4.1.15
EOR
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 0 0 1 S
16 15
Rn
12 11
Rd
shifter_operand
The EOR (Exclusive OR) instruction performs a bitwise Exclusive-OR of the value of register <Rn> with
the value of <shifter_operand>, and stores the result in the destination register <Rd>. The condition
code flags are optionally updated, based on the result.
Syntax
EOR{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the operation,
and the C flag is set to the carry output bit generated by the shifter (see Addressing
Mode 1 - Data-processing operands on page A5-2). The V flag and the rest of the
CPSR are unaffected.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the operation.
<shifter_operand>
Specifies the second operand for the operation. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not EOR.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-26
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn EOR shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
Usage
EOR can be used to invert selected bits in a register. For each bit, EOR with 1 inverts that bit, and EOR with
0 leaves it unchanged.
A4-27
ARM Instructions
4.1.16
LDC
31
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 P U N W 1
16 15
Rn
12 11
CRd
cp_num
8_bit_word_offset
The LDC (Load Coprocessor) instruction loads memory data from the sequence of consecutive memory
addresses calculated by <addressing_mode> to the coprocessor whose number is cp_num. If no
coprocessors indicate that they can execute the instruction, an Undefined Instruction exception is generated.
Syntax
LDC{<cond>}{L}
LDC2{L}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
LDC2
Causes the condition field of the instruction to be set to 0b1111. This provides additional
opcode space for coprocessor designers. The resulting instructions can only be executed
unconditionally.
Sets the N bit (bit[22]) in the instruction to 1 and specifies a long load (for example,
double-precision instead of single-precision data transfer). If L is omitted, the N bit is 0 and
the instruction specifies a short load.
<coproc>
Specifies the name of the coprocessor, and causes the corresponding coprocessor number to
be placed in the cp_num field of the instruction. The standard generic coprocessor names
are p0, p1, ..., p15.
<CRd>
<addressing_mode>
Is described in Addressing Mode 5 - Load and Store Coprocessor on page A5-56. It
determines the P, U, Rn, W and 8_bit_word_offset bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
LDC is in Version 2 and above.
LDC2 is in Version 5 and above.
A4-28
ARM Instructions
Exceptions
Undefined Instruction, Data Abort
Operation
if ConditionPassed(cond) then
address = start_address
load Memory[address,4] for Coprocessor[cp_num]
while (NotFinished(Coprocessor[cp_num]))
address = address + 4
load Memory[address,4] for Coprocessor[cp_num]
assert address == end_address
Usage
LDC is useful for loading coprocessor data from memory.
Notes
Coprocessor fields
Data abort
For details of the effects of the instruction if a Data Abort occurs, see Effects of
data-aborted instructions on page A2-17.
A4-29
ARM Instructions
4.1.17
LDM (1)
31
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 P U 0 W 1
16 15
Rn
register_list
This form of the LDM (Load Multiple) instruction is useful for block loads, stack operations and procedure
exit sequences. It loads a non-empty subset, or possibly all, of the general-purpose registers from sequential
memory locations.
The general-purpose registers loaded can include the PC. If they do, the word loaded for the PC is treated
as an address and a branch occurs to that address. In ARM architecture version 5 and above, bit[0] of the
loaded value determines whether execution continues after this branch in ARM state or in Thumb state, as
though a BX (loaded_value) instruction had been executed. In earlier versions of the architecture,
bits[1:0] of the loaded value are ignored and execution continues in ARM state, as though the instruction
MOV PC,(loaded_value) had been executed.
Syntax
LDM{<cond>}<addressing_mode>
<Rn>{!}, <registers>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<addressing_mode>
Is described in Addressing Mode 4 - Load and Store Multiple on page A5-48. It determines
the P, U, and W bits of the instruction.
<Rn>
Specifies the base register used by <addressing_mode>. Using R15 as the base register
<Rn> gives an UNPREDICTABLE result.
Sets the W bit, causing the instruction to write a modified value back to its base register Rn
as specified in Addressing Mode 4 - Load and Store Multiple on page A5-48. If ! is omitted,
the W bit is 0 and the instruction does not change its base register in this way. (However, if
the base register is included in <registers>, it changes when a value is loaded into it.)
<registers>
Is a list of registers, separated by commas and surrounded by { and }. It specifies the set of
registers to be loaded by the LDM instruction.
The registers are loaded in sequence, the lowest-numbered register from the lowest memory
address (start_address), through to the highest-numbered register from the highest
memory address (end_address). If the PC is specified in the register list (opcode bit[15]
is set), the instruction causes a branch to the address (data) loaded into the PC.
For each of i=0 to 15, bit[i] in the register_list field of the instruction is 1 if Ri is in the list
and 0 otherwise. If bits[15:0] are all zero, the result is UNPREDICTABLE.
A4-30
ARM Instructions
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
address = start_address
for i = 0 to 14
if register_list[i] == 1 then
Ri = Memory[address,4]
address = address + 4
if register_list[15] == 1 then
value = Memory[address,4]
if (architecture version 5 or above) then
pc = value AND 0xFFFFFFFE
T Bit = value[0]
else
pc = value AND 0xFFFFFFFC
address = address + 4
assert end_address = address - 4
Notes
Operand restrictions
If the base register <Rn> is specified in <registers>, and base register writeback is
specified, the final value of <Rn> is UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Non word-aligned addresses
Load Multiple instructions ignore the least significant two bits of address (the words are
not rotated as for Load Word).
Alignment
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor), and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception.
ARM/Thumb state transfers (ARM architecture version 5 and above)
Time order
If bits[1:0] of a value loaded for R15 are 0b10, the result is UNPREDICTABLE, as branches to
non word-aligned addresses are impossible in ARM state.
The time order of the accesses to individual words of memory generated by this instruction
is only defined in some circumstances. See Data accesses to memory-mapped I/O on
page A2-32 for details.
A4-31
ARM Instructions
4.1.18
LDM (2)
31
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 P U 1 0 1
16 15 14
Rn
register_list
This form of LDM loads User mode registers when the processor is in a privileged mode (useful when
performing process swaps, and in instruction emulators). The instruction loads a non-empty subset of
the User mode general-purpose registers from sequential memory locations.
Syntax
LDM{<cond>}<addressing_mode>
<Rn>, <registers_without_pc>^
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<addressing_mode>
Is described in Addressing Mode 4 - Load and Store Multiple on page A5-48. It determines
the P and U bits of the instruction. Only the forms of this addressing mode with W == 0 are
available for this form of the LDM instruction.
<Rn>
Specifies the base register used by <addressing_mode>. Using R15 as <Rn> gives an
UNPREDICTABLE result.
<registers_without_pc>
Is a list of registers, separated by commas and surrounded by { and }. This list must not
include the PC, and specifies the set of registers to be loaded by the LDM instruction.
The registers are loaded in sequence, the lowest-numbered register from the lowest memory
address (start_address), through to the highest-numbered register from the highest
memory address (end_address).
For each of i=0 to 15, bit[i] in the register_list field of the instruction is 1 if Ri is in the list
and 0 otherwise. If bits[15:0] are all zero, the result is UNPREDICTABLE.
^
For an LDM instruction that does not load the PC, this indicates that User mode registers are
to be loaded.
Architecture version
All
Exceptions
Data Abort
A4-32
ARM Instructions
Operation
if ConditionPassed(cond) then
address = start_address
for i = 0 to 14
if register_list[i] == 1
Ri_usr = Memory[address,4]
address = address + 4
assert end_address == address - 4
Notes
Banked registers
This form of LDM must not be followed by an instruction which accesses banked
registers (a following NOP is a good way to ensure this).
Writeback
The base register is read from the current processor mode registers, not the User
mode registers.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of
data-aborted instructions on page A2-17.
Time order
The time order of the accesses to individual words of memory generated by this
instruction is only defined in some circumstances. See Data accesses to
memory-mapped I/O on page A2-32 for details.
A4-33
ARM Instructions
4.1.19
LDM (3)
31
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 P U 1 W 1
16 15 14
Rn
register_list
This form of is useful for returning from an exception. It loads a subset (or possibly all) of the
general-purpose registers and the PC from sequential memory locations. Also, the SPSR of the current
mode is copied to the CPSR.
The value loaded for the PC is treated as an address and a branch occurs to that address. In ARM architecture
version 5 and above, and in T variants of version 4, the value copied from the SPSR T bit to the CPSR T bit
determines whether execution continues after the branch in ARM state or in Thumb state. In earlier
architecture versions, it continues after the branch in ARM state (the only possibility in those architecture
versions).
Syntax
LDM{<cond>}<addressing_mode>
<Rn>{!}, <registers_and_pc>^
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<addressing_mode>
Is described in Addressing Mode 4 - Load and Store Multiple on page A5-48. It determines
the P, U, and W bits of the instruction.
<Rn>
Specifies the base register used by <addressing_mode>. Using R15 as <Rn> gives an
UNPREDICTABLE result.
!
Sets the W bit, and the instruction writes a modified value back to its base register Rn (see
Addressing Mode 4 - Load and Store Multiple on page A5-48). If ! is omitted, the W bit is
0 and the instruction does not change its base register in this way. (However, if the base
register is included in <registers>, it changes when a value is loaded into it.)
<registers_and_pc>
Is a list of registers, separated by commas and surrounded by { and }. This list must include
the PC, and specifies the set of registers to be loaded by the LDM instruction.
The registers are loaded in sequence, the lowest-numbered register from the lowest memory
address (start_address), through to the highest-numbered register from the highest
memory address (end_address).
A4-34
For each of i=0 to 15, bit[i] in the register_list field of the instruction is 1 if Ri is in the list
and 0 otherwise.
For an LDM instruction that loads the PC, this indicates that the SPSR of the current mode
is copied to the CPSR.
ARM Instructions
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
address = start_address
for i = 0 to 14
if register_list[i] == 1 then
Ri = Memory[address,4]
address = address + 4
CPSR = SPSR
value = Memory[address,4]
if (architecture version 4T, 5 or above) and (T Bit == 1) then
pc = value AND 0xFFFFFFFE
else
pc = value AND 0xFFFFFFFC
address = address + 4
assert end_address = address - 4
Notes
User and System mode
This instruction is UNPREDICTABLE in User or System mode.
Operand restrictions
If the base register <Rn> is specified in <registers_and_pc>, and base register
writeback is specified, the final value of <Rn> is UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-35
ARM Instructions
UNPREDICTABLE because
Time order
A4-36
The time order of the accesses to individual words of memory generated by this instruction
is not defined. See Data accesses to memory-mapped I/O on page A2-32 for details.
ARM Instructions
4.1.20
LDR
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I P U 0 W 1
16 15
Rn
12 11
Rd
addr_mode
The LDR (Load Register) instruction loads a word from the memory address calculated by
<addressing_mode> and writes it to register <Rd>. If the address is not word-aligned, the loaded value
is rotated right by 8 times the value of bits[1:0] of the address. For a little-endian memory system, this
rotation causes the addressed byte to occupy the least significant byte of the register. For a big-endian
memory system, it causes the addressed byte to occupy bits[31:24] or bits[15:8] of the register, depending
on whether bit[0] of the address is 0 or 1 respectively.
If the PC is specified as register <Rd>, the instruction loads a data word which it treats as an address, then
branches to that address. In ARM architecture version 5 and above, bit[0] of the loaded value determines
whether execution continues after this branch in ARM state or in Thumb state, as though a BX
(loaded_value) instruction had been executed. In earlier versions of the architecture, bits[1:0] of the
loaded value are ignored and execution continues in ARM state, as though a MOV PC,(loaded_value)
instruction had been executed.
Syntax
LDR{<cond>}
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, P, U, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
All
Exceptions
Data Abort
A4-37
ARM Instructions
Operation
if ConditionPassed(cond) then
if address[1:0] == 0b00 then
value = Memory[address,4]
else if address[1:0] == 0b01 then
value = Memory[address,4] Rotate_Right 8
else if address[1:0] == 0b10 then
value = Memory[address,4] Rotate_Right 16
else /* address[1:0] == 0b11 */
value = Memory[address,4] Rotate_Right 24
if (Rd is R15) then
if (architecture version 5 or above) then
PC = value AND 0xFFFFFFFE
T Bit = value[0]
else
PC = value AND 0xFFFFFFFC
else
Rd = value
Usage
Using the PC as the base register allows PC-relative addressing, which facilitates position-independent
code. Combined with a suitable addressing mode, LDR allows 32-bit memory data to be loaded into a
general-purpose register where its value can be manipulated. If the destination register is the PC, this
instruction loads a 32-bit address from memory and branches to that address.
To synthesize a Branch with Link, precede the LDR instruction with MOV LR, PC.
A4-38
ARM Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Operand restrictions
A4-39
ARM Instructions
4.1.21
LDRB
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I P U 1 W 1
16 15
Rn
12 11
Rd
addr_mode
The LDRB (Load Register Byte) instruction loads a byte from the memory address calculated by
<addressing_mode>, zero-extends the byte to a 32-bit word, and writes the word to register <Rd>.
Syntax
LDR{<cond>}B
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the destination register for the loaded value. If register 15 is specified for <Rd>,
the result is UNPREDICTABLE.
<addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, P, U, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
Rd = Memory[address,1]
Usage
Combined with a suitable addressing mode, LDRB allows 8-bit memory data to be loaded into a
general-purpose register where it can be manipulated.
Using the PC as the base register allows PC-relative addressing, to facilitate position-independent code.
A4-40
ARM Instructions
Notes
Operand restrictions
If <addressing_mode> specifies base register writeback, and the same register is
specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-41
ARM Instructions
4.1.22
LDRBT
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I 0 U 1 1 1
16 15
Rn
12 11
Rd
addr_mode
The LDRBT (Load Register Byte with Translation) instruction loads a byte from the memory address
calculated by <post_indexed_addressing_mode>, zero-extends the byte to a 32-bit word, and
writes the word to register <Rd>.
If the instruction is executed when the processor is in a privileged mode, the memory system is signaled to
treat the access as if the processor were in User mode.
Syntax
LDR{<cond>}BT
<Rd>, <post_indexed_addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the destination register for the loaded value. If R15 is specified for <Rd>, the
result is UNPREDICTABLE.
<post_indexed_addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, U, Rn and addr_mode bits of the instruction. Only post-indexed forms
of Addressing Mode 2 are available for this instruction. These forms have P == 0 and W ==
0, where P and W are bit[24] and bit[21] respectively. This instruction uses P == 0 and W
== 1 instead, but the addressing mode is the same in all other respects.
The syntax of all forms of <post_indexed_addressing_mode> includes a base
register <Rn>. All forms also specify that the instruction modifies the base register value
(this is known as base register writeback).
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
Rd = Memory[address,1]
A4-42
ARM Instructions
Usage
LDRBT can be used by a (privileged) exception handler that is emulating a memory access instruction that
would normally execute in User mode. The access is restricted as if it had User mode privilege.
Notes
User mode
If this instruction is executed in User mode, an ordinary User mode access is performed.
Operand restrictions
If the same register is specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-43
ARM Instructions
4.1.23
LDRH
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U I W 1
16 15
Rn
12 11
Rd
4 3
addr_mode 1 0 1 1 addr_mode
The LDRH (Load Register Halfword) instruction loads a halfword from the memory address calculated by
<addressing_mode>, zero-extends the halfword to a 32-bit word, and writes the word to
register <Rd>. If the address is not halfword-aligned, the result is UNPREDICTABLE.
Syntax
LDR{<cond>}H
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the destination register for the loaded value. If R15 is specified for <Rd>, the
result is UNPREDICTABLE.
<addressing_mode>
Is described in Addressing Mode 3 - Miscellaneous Loads and Stores on page A5-34. It
determines the P, U, I, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
Version 4 and above
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
if address[0] == 0
data = Memory[address,2]
else /* address[0] == 1 */
data = UNPREDICTABLE
Rd = data
A4-44
ARM Instructions
Usage
Used with a suitable addressing mode, LDRH allows 16-bit memory data to be loaded into a general-purpose
register where its value can be manipulated.
Using the PC as the base register allows PC-relative addressing to facilitate position-independent code.
Notes
Operand restrictions
If <addressing_mode> specifies base register writeback, and the same register is
specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-45
ARM Instructions
4.1.24
LDRSB
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U I W 1
16 15
Rn
12 11
Rd
4 3
addr_mode 1 1 0 1 addr_mode
The LDRSB (Load Register Signed Byte) instruction loads a byte from the memory address calculated by
<addressing_mode>, sign-extends the byte to a 32-bit word, and writes the word to register <Rd>.
Syntax
LDR{<cond>}SB
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the destination register for the loaded value. If R15 is specified for <Rd>, the
result is UNPREDICTABLE.
<addressing_mode>
Is described in Addressing Mode 3 - Miscellaneous Loads and Stores on page A5-34. It
determines the P, U, I, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
Version 4 and above
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
data = Memory[address,1]
Rd = SignExtend(data)
Usage
Used with a suitable addressing mode, LDRSB allows 8-bit signed memory data to be loaded into a
general-purpose register where it can be manipulated. Using the PC as the base register allows PC-relative
addressing, which facilitates position-independent code.
A4-46
ARM Instructions
Notes
Operand restrictions
If <addressing_mode> specifies base register writeback, and the same register is
specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-47
ARM Instructions
4.1.25
LDRSH
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U I W 1
16 15
Rn
12 11
Rd
4 3
addr_mode 1 1 1 1 addr_mode
The LDRSH (Load Register Signed Halfword) instruction loads a halfword from the memory address
calculated by <addressing_mode>, sign-extends the halfword to a 32-bit word, and writes the word to
register <Rd>. If the address is not halfword-aligned, the result is UNPREDICTABLE.
Syntax
LDR{<cond>}SH
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the destination register for the loaded value. If R15 is specified for <Rd>, the
result is UNPREDICTABLE.
<addressing_mode>
Is described in Addressing Mode 3 - Miscellaneous Loads and Stores on page A5-34. It
determines the P, U, I, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
Version 4 and above
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
if address[0] == 0
data = Memory[address,2]
else /* address[0] == 1 */
data = UNPREDICTABLE
Rd = SignExtend(data)
A4-48
ARM Instructions
Usage
Used with a suitable addressing mode, LDRSH allows 16-bit signed memory data to be loaded into
a general-purpose register where its value can be manipulated.
Using the PC as the base register allows PC-relative addressing, which facilitates position-independent
code.
Notes
Operand restrictions
If <addressing_mode> specifies base register writeback, and the same register is
specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-49
ARM Instructions
4.1.26
LDRT
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I 0 U 0 1 1
16 15
Rn
12 11
Rd
addr_mode
The LDRT (Load Register with Translation) instruction loads a word from the memory address calculated
by <addressing_mode> and writes it to register <Rd>. If the address is not word-aligned, the loaded
data is rotated as for the LDR instruction (see LDR on page A4-37).
If the instruction is executed when the processor is in a privileged mode, the memory system is signaled to
treat the access as if the processor were in User mode.
Syntax
LDR{<cond>}T
<Rd>, <post_indexed_addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the destination register for the loaded value. If R15 is specified for <Rd>, the
result is UNPREDICTABLE.
<post_indexed_addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, U, Rn and addr_mode bits of the instruction. Only post-indexed forms
of Addressing Mode 2 are available for this instruction. These forms have P == 0 and W ==
0, where P and W are bit[24] and bit[21] respectively. This instruction uses P == 0 and W
== 1 instead, but the addressing mode is the same in all other respects.
The syntax of all forms of <post_indexed_addressing_mode> includes a base
register <Rn>. All forms also specify that the instruction modifies the base register value
(this is known as base register writeback).
Architecture version
All
Exceptions
Data Abort
A4-50
ARM Instructions
Operation
if ConditionPassed(cond) then
if address[1:0] == 0b00
Rd = Memory[address,4]
else if address[1:0] == 0b01
Rd = Memory[address,4] Rotate_Right 8
else if address[1:0] == 0b10
Rd = Memory[address,4] Rotate_Right 16
else /* address[1:0] == 0b11 */
Rd = Memory[address,4] Rotate_Right 24
Usage
LDRT can be used by a (privileged) exception handler that is emulating a memory access instruction that
would normally execute in User mode. The access is restricted as if it had User mode privilege.
Notes
User mode
If this instruction is executed in User mode, an ordinary User mode access is performed.
Operand restrictions
If the same register is specified for <Rd> and <Rn> the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
A4-51
ARM Instructions
4.1.27
MCR
31
28 27 26 25 24 23
cond
21 20 19
1 1 1 0 opcode_1 0
16 15
CRn
12 11
Rd
cp_num
4 3
opcode_2 1
CRm
The MCR (Move to Coprocessor from ARM Register) instruction passes the value of register <Rd> to the
coprocessor whose number is cp_num. If no coprocessors indicate that they can execute the instruction, an
Undefined Instruction exception is generated.
Syntax
MCR{<cond>}
MCR2
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
MCR2
Causes the condition field of the instruction to be set to 0b1111. This provides additional
opcode space for coprocessor designers. The resulting instructions can only be executed
unconditionally.
<coproc>
Specifies the name of the coprocessor, and causes the corresponding coprocessor number to
be placed in the cp_num field of the instruction. The standard generic coprocessor names
are p0, p1, ..., p15.
Is the ARM register whose value is transferred to the coprocessor. If R15 is specified for
<Rd>, the result is UNPREDICTABLE.
<CRn>
<CRm>
Architecture version
MCR is in version 2 and above.
MCR2 is in version 5 and above.
Exceptions
Undefined Instruction
A4-52
ARM Instructions
Operation
if ConditionPassed(cond) then
send Rd value to Coprocessor[cp_num]
Usage
MCR is used to initiate coprocessor instructions that operate on values in ARM registers. An example is
a fixed-point to floating-point conversion instruction for a floating-point coprocessor.
Notes
Coprocessor fields
Only instruction bits[31:24], bit[20], bits[15:8], and bit[4] are defined by the ARM
architecture. The remaining fields are recommendations, for compatibility with
ARM Development Systems.
A4-53
ARM Instructions
4.1.28
MLA
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 0 0 1 S
16 15
Rd
12 11
Rn
Rs
4 3
1 0 0 1
Rm
The MLA (Multiply Accumulate) multiplies signed or unsigned operands to produce a 32-bit result, which
is then added to a third operand, and written to the destination register. The condition code flags are
optionally updated, based on the result.
Syntax
MLA{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR by setting the N and Z flags according to the result of the
multiply-accumulate. If S is omitted, the S bit of the instruction is set to 0 and the entire
CPSR is unaffected by the instruction.
<Rd>
<Rm>
<Rs>
<Rn>
Contains the value that is added to the product of <Rs> and <Rm>.
Architecture version
Version 2 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = (Rm * Rs + Rn)[31:0]
if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = unaffected
/* See "C flag" note */
V Flag = unaffected
A4-54
ARM Instructions
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, <Rs>, or <Rn> has UNPREDICTABLE
results.
Operand restriction Specifying the same register for <Rd> and <Rm> has UNPREDICTABLE results.
Early termination
Signed and unsigned Because the MLA instruction produces only the lower 32 bits of the 64-bit product,
MLA gives the same answer for multiplication of both signed and unsigned numbers.
C flag
The MLAS instruction is defined to leave the C flag unchanged in ARM architecture
version 5 and above. In earlier versions of the architecture, the value of the C flag
was UNPREDICTABLE after a MLAS instruction.
A4-55
ARM Instructions
4.1.29
MOV
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 1 0 1 S
16 15
SBZ
12 11
Rd
shifter_operand
The MOV (Move) instruction moves the value of <shifter_operand> to the destination register <Rd>.
The condition code flags are optionally updated, based on the result.
Syntax
MOV{<cond>}{S}
<Rd>, <shifter_operand>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
<Rd>
If <Rd> is not R15, the N and Z flags are set according to the value moved (post-shift
if a shift is specified), and the C flag is set to the carry output bit generated by the
shifter (see Addressing Mode 1 - Data-processing operands on page A5-2). The V
flag and the rest of the CPSR are unaffected.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<shifter_operand>
Specifies the operand for the operation. The options for this operand are described in
Addressing Mode 1 - Data-processing operands on page A5-2, including how each option
causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not MOV.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
Exceptions
None
A4-56
ARM Instructions
Operation
if ConditionPassed(cond) then
Rd = shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
Usage
MOV is used to:
Perform a shift without any other arithmetic or logical operation. A left shift by n can be used to
multiply by 2n.
When the PC is the destination of the instruction, a branch occurs. The instruction:
MOV PC, LR
can therefore be used to return from a subroutine (see instructions B, BL on page A4-10). In T
variants of architecture 4 and in architecture 5 and above, the instruction BX LR must be used in place
of MOV PC, LR, as the BX instruction automatically switches back to Thumb state if appropriate.
When the PC is the destination of the instruction and the S bit is set, a branch occurs and the SPSR
of the current mode is copied to the CPSR. This means that a MOVS PC, LR instruction can be used
to return from some types of exception (see Exceptions on page A2-13).
A4-57
ARM Instructions
4.1.30
MRC
31
28 27 26 25 24 23
cond
21 20 19
1 1 1 0 opcode_1 1
16 15
CRn
12 11
Rd
cp_num
4 3
opcode_2 1
CRm
The MRC (Move to ARM Register from Coprocessor) instruction causes the coprocessor whose number is
cp_num to transfer a value to an ARM register or to the condition flags.
If no coprocessors indicate that they can execute the instruction an Undefined Instruction exception is
generated.
Syntax
MRC{<cond>}
MRC2
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined
in The condition field on page A3-5. If <cond> is omitted, the AL (always)
condition is used.
MRC2
Causes the condition field of the instruction to be set to 0b1111. This provides
additional opcode space for coprocessor designers. The resulting instructions can
only be executed unconditionally.
<coproc>
Specifies the name of the coprocessor, and causes the corresponding coprocessor
number to be placed in the cp_num field of the instruction. The standard generic
coprocessor names are p0, p1, ..., p15.
<opcode_1>
Is a coprocessor-specific opcode.
<Rd>
Specifies the destination ARM register for the instruction. If R15 is specified for
<Rd>, the condition code flags are updated instead of a general-purpose register.
<CRn>
Specifies the coprocessor register that contains the first operand for the instruction.
<CRm>
<opcode_2>
Architecture version
MRC is in version 2 and above.
MRC2 is in version 5 and above.
Exceptions
Undefined Instruction
A4-58
ARM Instructions
Operation
if ConditionPassed(cond) then
data = value from Coprocessor[cp_num]
if Rd is R15 then
N flag = data[31]
Z flag = data[30]
C flag = data[29]
V flag = data[28]
else /* Rd is not R15 */
Rd = data
Usage
MRC has two uses:
1.
If <Rd> specifies R15, the condition code flags bits are updated from the top four bits of the value
from the coprocessor specified by <coproc> (to allow conditional branching on the status of a
coprocessor) and the other 28 bits are ignored.
An example of this use would be to transfer the result of a comparison performed by a floating-point
coprocessor to the ARMs condition flags.
2.
Otherwise the instruction writes into register <Rd> a value from the coprocessor specified by
<coproc>.
An example of this use is a floating-point to integer conversion instruction in a floating-point
coprocessor.
Notes
Coprocessor fields
Only instruction bits[31:24], bit[20], bits[15:8] and bit[4] are defined by the ARM
architecture. The remaining fields are recommendations, for compatibility with
ARM Development Systems.
A4-59
ARM Instructions
4.1.31
MRS
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 R 0 0
16 15
SBO
12 11
Rd
SBZ
The MRS (Move PSR to General-purpose Register) instruction moves the value of the CPSR or the SPSR
of the current mode into a general-purpose register. In the general-purpose register, the value can be
examined or manipulated with normal data-processing instructions.
Syntax
MRS{<cond>}
MRS{<cond>}
where:
<cond>
<Rd>
<Rd>, CPSR
<Rd>, SPSR
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Specifies the destination register of the instruction. If R15 is specified for <Rd>, the result
is UNPREDICTABLE.
Architecture version
Version 3 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
if R == 1 then
Rd = SPSR
else
Rd = CPSR
A4-60
ARM Instructions
Usage
The MRS instruction is commonly used for three purposes:
As part of a read/modify/write sequence for updating a PSR. For more details, see MSR on
page A4-62.
When an exception occurs and there is a possibility of a nested exception of the same type occurring,
the SPSR of the exception mode is in danger of being corrupted. To deal with this, the SPSR value
must be saved before the nested exception can occur, and later restored in preparation for the
exception return. The saving is normally done by using an MRS instruction followed by a store
instruction. Restoring the SPSR uses the reverse sequence of a load instruction followed by an MSR
instruction. For an example of this usage, see Interrupt prioritization on page A9-15.
In process swap code, the programmer's model state of the process being swapped out needs to be
saved, including relevant PSR contents, and similar state of the process being swapped in needs to be
restored. Again, this involves the use of MRS/store and load/MSR instruction sequences. For an
example of this usage, see Context switch on page A9-16.
Notes
Opcode [11:0]
Opcode [19:16]
A4-61
ARM Instructions
4.1.32
MSR
Immediate operand:
31
28 27 26 25 24 23 22 21 20 19
cond
16 15
0 0 1 1 0 R 1 0 field_mask
12 11
SBO
rotate_imm
8_bit_immediate
Register operand:
31
28 27 26 25 24 23 22 21 20 19
cond
16 15
0 0 0 1 0 R 1 0 field_mask
12 11
SBO
SBZ
4 3
0 0 0 0
Rm
The MSR (Move to Status Register from ARM Register) instruction transfers the value of a general-purpose
register or immediate constant to the CPSR or the SPSR of the current mode.
Syntax
MSR{<cond>}
MSR{<cond>}
MSR{<cond>}
MSR{<cond>}
CPSR_<fields>,
CPSR_<fields>,
SPSR_<fields>,
SPSR_<fields>,
#<immediate>
<Rm>
#<immediate>
<Rm>
where:
A4-62
<cond>
Is the condition under which the instruction is executed. The conditions are defined
in The condition field on page A3-5. If <cond> is omitted, the AL (always)
condition is used.
<fields>
<immediate>
<Rm>
ARM Instructions
Architecture version
Version 3 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
if opcode[25] == 1
operand = 8_bit_immediate Rotate_Right (rotate_imm * 2)
else /* opcode[25] == 0 */
operand = Rm
if R == 0 then
if field_mask[0] == 1 and InAPrivilegedMode() then
CPSR[7:0] = operand[7:0]
if field_mask[1] == 1 and InAPrivilegedMode() then
CPSR[15:8] = operand[15:8]
if field_mask[2] == 1 and InAPrivilegedMode() then
CPSR[23:16] = operand[23:16]
if field_mask[3] == 1 then
CPSR[31:24] = operand[31:24]
else /* R == 1 */
if field_mask[0] == 1 and CurrentModeHasSPSR() then
SPSR[7:0] = operand[7:0]
if field_mask[1] == 1 and CurrentModeHasSPSR() then
SPSR[15:8] = operand[15:8]
if field_mask[2] == 1 and CurrentModeHasSPSR() then
SPSR[23:16] = operand[23:16]
if field_mask[3] == 1 and CurrentModeHasSPSR() then
SPSR[31:24] = operand[31:24]
Usage
This instruction is used to update the value of the condition code flags, interrupt enables, or the processor
mode.
The value of a PSR should normally be updated by moving the PSR to a general-purpose register (using the
MRS instruction), modifying the relevant bits of the general-purpose register, and restoring the updated
general-purpose register value back into the PSR (using the MSR instruction). For example, a good way to
switch the ARM to Supervisor mode from another privileged mode is:
MRS
BIC
ORR
MSR
R0,CPSR
R0,R0,#0x1F
R0,R0,#0x13
CPSR_c,R0
;
;
;
;
Read CPSR
Modify by removing current mode
and substituting Supervisor mode
Write the result back to CPSR
A4-63
ARM Instructions
For maximum efficiency, MSR instructions should only write to those fields that they can potentially change.
For example, the last instruction in the above code can only change the CPSR control field, as all bits in the
other fields are unchanged since they were read from the CPSR by the first instruction. So it writes to
CPSR_c, not CPSR_fsxc or some other combination of fields.
However, if the only reason that an MSR instruction cannot change a field is that no bits are currently
allocated to the field, then the field must be written, to ensure future compatibility. For example, when the
process swap code in Context switch on page A9-16 restores the new processs CPSR value, it writes to
SPSR_fsxc (which is later copied to the CPSR by the LDM instruction which restarts the process). There are
no bits allocated to the state or extension fields at present, so writing to SPSR_fc would work just as well
in current architecture versions (5 and below). However, writing to SPSR_fsxc will continue to work
correctly in future versions of the architecture that do have bits allocated in the state or extension fields,
while writing to SPSR_fc will not.
Note
Due to deficiencies in the handling of the state and extension fields in versions 2.50 and below of the ARM
Software Development Toolkit, only specify the flags and control fields when using these toolkit versions.
In cases where the above guidelines mean that the state and extension fields should have been written for
future compatibility, it is recommended that you keep a record of the need to change the set of fields
specified when it becomes possible to do so.
The immediate form of this instruction can be used to set any of the fields of a PSR, but you must take care
to adhere to the read-modify-write technique described above. The immediate form of the instruction is
equivalent to reading the PSR concerned, replacing all the bits in the fields concerned by the corresponding
bits of the immediate constant and writing the result back to the PSR. The immediate form must therefore
only be used when the intention is to modify all the bits in the specified fields and, in particular, must not
be used if the specified fields include any as-yet-unallocated bits. Failure to observe this rule might result
in code which has unanticipated side-effects on future versions of the ARM architecture.
As an exception to the above rule, it is legitimate to use the immediate form of the instruction to modify the
flags byte, despite the fact that bits[26:24] of the PSRs have no allocated function at present. For example,
this instruction can be used to set all four flags (and clear the Q flag if the processor implements the
Enhanced DSP extension):
MSR
CPSR_f,#0xF0000000
Any functionality allocated to bits[26:24] in a future version of the ARM architecture will be designed so
that such code does not have unexpected side effects.
A4-64
ARM Instructions
Notes
The R bit
Bit[22] of the instruction is 0 if the CPSR is to be written and 1 if the SPSR is to be written.
The MSR instruction must not be used to alter the T bit in the CPSR. If such an attempt is
made, the results are UNPREDICTABLE.
Addressing modes
The immediate and register forms are specified in precisely the same way as the immediate
and unshifted register forms of Addressing Mode 1 (see Addressing Mode 1 Data-processing operands on page A5-2). All other forms of Addressing Mode 1 yield
UNPREDICTABLE results.
A4-65
ARM Instructions
4.1.33
MUL
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 0 0 0 S
16 15
Rd
12 11
SBZ
Rs
4 3
1 0 0 1
Rm
The MUL (Multiply) instruction is used to multiply signed or unsigned variables to produce a 32-bit result.
The condition code flags are optionally updated, based on the result.
Syntax
MUL{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR by setting the N and Z flags according to the result of the multiplication.
If S is omitted, the S bit of the instruction is set to 0 and the entire CPSR is unaffected by
the instruction.
<Rd>
<Rm>
<Rs>
Architecture version
Version 2 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = (Rm * Rs)[31:0]
if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = unaffected
/* See "C flag" note */
V Flag = unaffected
A4-66
ARM Instructions
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, or <Rs> has UNPREDICTABLE results.
Operand restriction Specifying the same register for <Rd> and <Rm> has UNPREDICTABLE results.
Early termination
Signed and unsigned Because the MUL instruction produces only the lower 32 bits of the 64-bit product,
MUL gives the same answer for multiplication of both signed and unsigned numbers.
C flag
The MULS instruction is defined to leave the C flag unchanged in ARM architecture
version 5 and above. In earlier versions of the architecture, the value of the C flag
was UNPREDICTABLE after a MULS instruction.
A4-67
ARM Instructions
4.1.34
MVN
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 1 1 1 S
16 15
SBZ
12 11
Rd
shifter_operand
The MVN (Move Negative) instruction moves the logical ones complement of the value of
<shifter_operand> to the destination register <Rd>. The condition code flags are optionally updated,
based on the result.
Syntax
MVN{<cond>}{S}
<Rd>, <shifter_operand>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
<Rd>
If <Rd> is not R15, the N and Z flags are set according to the result of the operation,
and the C flag is set to the carry output bit generated by the shifter (see Addressing
Mode 1 - Data-processing operands on page A5-2). The V flag and the rest of the
CPSR are unaffected.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<shifter_operand>
Specifies the operand for the operation. The options for this operand are described in
Addressing Mode 1 - Data-processing operands on page A5-2, including how each option
causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not MVN.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
Exceptions
None
A4-68
ARM Instructions
Operation
if ConditionPassed(cond) then
Rd = NOT shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
Usage
MVN is used to:
A4-69
ARM Instructions
4.1.35
ORR
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 1 0 0 S
16 15
Rn
12 11
Rd
shifter_operand
The ORR (Logical OR) instruction performs a bitwise (inclusive) OR of the value of register <Rn> with the
value of <shifter_operand>, and stores the result in the destination register <Rd>. The condition
code flags are optionally updated, based on the result.
Syntax
ORR{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the operation,
and the C flag is set to the carry output bit generated by the shifter (see Addressing
Mode 1 - Data-processing operands on page A5-2). The V flag and the rest of the
CPSR are unaffected.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the operation.
<shifter_operand>
Specifies the second operand for the operation. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not ORR.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-70
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn OR shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
Usage
ORR can be used to set selected bits in a register. For each bit, OR with 1 sets the bit, and OR with 0 leaves
it unchanged.
A4-71
ARM Instructions
4.1.36
RSB
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 0 1 1 S
16 15
Rn
12 11
Rd
shifter_operand
The RSB (Reverse Subtract) instruction subtracts the value of register <Rn> from the value of
<shifter_operand>, and stores the result in the destination register <Rd>. The condition code flags
are optionally updated, based on the result.
Syntax
RSB{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the subtraction,
and the C and V flags are set according to whether the subtraction generated a borrow
(unsigned underflow) and a signed overflow, respectively. The rest of the CPSR is
unchanged.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the second operand for the subtraction.
<shifter_operand>
Specifies the first operand for the subtraction. The options for this operand are described in
Addressing Mode 1 - Data-processing operands on page A5-2, including how each option
causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not RSB.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-72
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = shifter_operand - Rn
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(shifter_operand - Rn)
V Flag = OverflowFrom(shifter_operand - Rn)
Usage
The following instruction stores the negation (twos complement) of Rx in Rd:
RSB Rd, Rx, #0
Constant multiplication (of Rx) by 2n1 (into Rd) can be performed with:
RSB Rd, Rx, Rx, LSL #n
Notes
C flag
The SBC and RSC instructions use the C flag as a NOT(borrow) operand, performing
a normal subtraction if C == 1 and subtracting one more than usual if C == 0.
A4-73
ARM Instructions
4.1.37
RSC
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 1 1 1 S
16 15
Rn
12 11
Rd
shifter_operand
The RSC (Reverse Subtract with Carry) instruction subtracts the value of register <Rn> and the value of
NOT(Carry flag) from the value of <shifter_operand>, and stores the result in the destination register
<Rd>. The condition code flags are optionally updated, based on the result.
Syntax
RSC{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the subtraction,
and the C and V flags are set according to whether the subtraction generated a borrow
(unsigned underflow) and a signed overflow, respectively. The rest of the CPSR is
unchanged.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the second operand for the subtraction.
<shifter_operand>
Specifies the first operand for the subtraction. The options for this operand are described in
Addressing Mode 1 - Data-processing operands on page A5-2, including how each option
causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not RSC.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-74
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = shifter_operand - Rn - NOT(C Flag)
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(shifter_operand - Rn - NOT(C Flag))
V Flag = OverflowFrom(shifter_operand - Rn - NOT(C Flag))
Usage
To negate the 64-bit value in R0,R1, use the following sequence (R0 holds the least significant word) which
stores the result in R2,R3:
RSBS
RSC
R2,R0,#0
R3,R1,#0
Notes
C flag
The SBC and RSC instructions use the C flag as a NOT(borrow) operand, performing
a normal subtraction if C == 1 and subtracting one more than usual if C == 0.
A4-75
ARM Instructions
4.1.38
SBC
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 1 1 0 S
16 15
Rn
12 11
Rd
shifter_operand
The SBC (Subtract with Carry) instruction is used to synthesize multi-word subtraction. SBC subtracts the
value of <shifter_operand> and the value of NOT(Carry flag) from the value of register <Rn>, and
stores the result in the destination register <Rd>. The condition code flags are optionally updated, based on
the result.
Syntax
SBC{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the subtraction,
and the C and V flags are set according to whether the subtraction generated a borrow
(unsigned underflow) and a signed overflow, respectively. The rest of the CPSR is
unchanged.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the subtraction.
<shifter_operand>
Specifies the second operand for the subtraction. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not SBC.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-76
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn - shifter_operand - NOT(C Flag)
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - shifter_operand - NOT(C Flag))
V Flag = OverflowFrom(Rn - shifter_operand - NOT(C Flag))
Usage
If register pairs R0,R1 and R2,R3 hold 64-bit values (R0 and R2 hold the least significant words), the
following instructions leave the 64-bit difference in R4,R5:
SUBS
SBC
R4,R0,R2
R5,R1,R3
Notes
C flag
The SBC and RSC instructions use the C flag as a NOT(borrow) operand, performing
a normal subtraction if C == 1 and subtracting one more than usual if C == 0.
A4-77
ARM Instructions
4.1.39
SMLAL
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 1 1 1 S
16 15
RdHi
12 11
RdLo
Rs
4 3
1 0 0 1
Rm
The SMLAL (Signed Multiply Accumulate Long) instruction multiplies the signed value of register <Rm>
with the signed value of register <Rs> to produce a 64-bit product. This product is added to the 64-bit value
held in <RdHi> and <RdLo>, and the sum is written back to <RdHi> and <RdLo>. The condition code
flags are optionally updated, based on the result.
Syntax
SMLAL{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR by setting the N and Z flags according to the result of the
multiply-accumulate. If S is omitted, the S bit of the instruction is set to 0 and the entire
CPSR is unaffected by the instruction.
<RdLo>
Supplies the lower 32 bits of the value to be added to the product of <Rm> and <Rs>, and
is the destination register for the lower 32 bits of the result.
<RdHi>
Supplies the upper 32 bits of the value to be added to the product of <Rm> and <Rs>, and
is the destination register for the upper 32 bits of the result.
<Rm>
<Rs>
Architecture version
All M variants
Exceptions
None
A4-78
ARM Instructions
Operation
if ConditionPassed(cond) then
RdLo = (Rm * Rs)[31:0] + RdLo /* Signed multiplication */
RdHi = (Rm * Rs)[63:32] + RdHi + CarryFrom((Rm * Rs)[31:0] + RdLo)
if S == 1 then
N Flag = RdHi[31]
Z Flag = if (RdHi == 0) and (RdLo == 0) then 1 else 0
C Flag = unaffected
/* See "C and V flags" note */
V Flag = unaffected
/* See "C and V flags" note */
Usage
SMLAL multiplies signed variables to produce a 64-bit result, which is added to the 64-bit value in the two
destination general-purpose registers. The result is written back to the two destination general-purpose
registers.
Notes
Use of R15
UNPREDICTABLE
Operand restriction <RdHi>, <RdLo>, and <Rm> must be three distinct registers, or the results are
UNPREDICTABLE.
Early termination
C and V flags
The SMLALS instruction is defined to leave the C and V flags unchanged in ARM
architecture version 5 and above. In earlier versions of the architecture, the values
of the C and V flags were UNPREDICTABLE after an SMLALS instruction.
A4-79
ARM Instructions
4.1.40
SMULL
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 1 1 0 S
16 15
RdHi
12 11
RdLo
Rs
4 3
1 0 0 1
Rm
The SMULL (Signed Multiply Long) instruction multiplies the signed value of register <Rm> with the signed
value of register <Rs> to produce a 64-bit result. The upper 32 bits of the result are stored in <RdHi>.
The lower 32 bits are stored in <RdLo>. The condition code flags are optionally updated, based on the
64-bit result.
Syntax
SMULL{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR by setting the N and Z flags according to the result of the multiplication.
If S is omitted, the S bit of the instruction is set to 0 and the entire CPSR is unaffected by
the instruction.
<RdLo>
<RdHi>
<Rm>
<Rs>
Architecture version
All M variants
Exceptions
None
A4-80
ARM Instructions
Operation
if ConditionPassed(cond) then
RdHi = (Rm * Rs)[63:32] /* Signed multiplication */
RdLo = (Rm * Rs)[31:0]
if S == 1 then
N Flag = RdHi[31]
Z Flag = if (RdHi == 0) and (RdLo == 0) then 1 else 0
C Flag = unaffected
/* See "C and V flags" note */
V Flag = unaffected
/* See "C and V flags" note */
Usage
SMULL multiplies signed variables to produce a 64-bit result in two general-purpose registers.
Notes
Use of R15
UNPREDICTABLE
Operand restriction <RdHi>, <RdLo>, and <Rm> must be three distinct registers, or the results are
UNPREDICTABLE.
Early termination
C and V flags
The SMULLS instruction is defined to leave the C and V flags unchanged in ARM
architecture version 5 and above. In earlier versions of the architecture, the values
of the C and V flags were UNPREDICTABLE after an SMULLS instruction.
A4-81
ARM Instructions
4.1.41
STC
31
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 P U N W 0
16 15
Rn
12 11
CRd
cp_num
8_bit_word_offset
The STC (Store Coprocessor) instruction stores data from the coprocessor whose name is cp_num to the
sequence of consecutive memory addresses calculated by <addressing_mode>. If no coprocessors
indicate that they can execute the instruction, an Undefined Instruction exception is generated.
Syntax
STC{<cond>}{L}
STC2{L}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
STC2
Causes the condition field of the instruction to be set to 0b1111. This provides additional
opcode space for coprocessor designers. The resulting instructions can only be executed
unconditionally.
Sets the N bit (bit[22]) in the instruction to 1 and specifies a long store (for example,
double-precision instead of single-precision data transfer). If L is omitted, the N bit is 0 and
the instruction specifies a short store.
<coproc>
Specifies the name of the coprocessor, and causes the corresponding coprocessor number to
be placed in the cp_num field of the instruction. The standard generic coprocessor names
are p0, p1, ..., p15.
<CRd>
<addressing_mode>
Is described in Addressing Mode 5 - Load and Store Coprocessor on page A5-56. It
determines the P, U, Rn, W and 8_bit_word_offset bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
STC is in version 2 and above.
STC2 is in version 5 and above.
A4-82
ARM Instructions
Exceptions
Undefined Instruction, Data Abort
Operation
if ConditionPassed(cond) then
address = start_address
Memory[address,4] = value from Coprocessor[cp_num]
while (NotFinished(coprocessor[cp_num]))
address = address + 4
Memory[address,4] = value from Coprocessor[cp_num]
assert address == end_address
Usage
STC is useful for storing coprocessor data to memory. The L (long) option controls the N bit and could be
used to distinguish between a single- and double-precision transfer for a floating-point store instruction.
Notes
Coprocessor fields
Only instruction bits[31:23], bits[21:16} and bits[11:0] are defined by the ARM
architecture. The remaining fields (bit[22] and bits[15:12]) are recommendations,
for compatibility with ARM Development Systems.
In the case of the Unindexed addressing mode (P==0, U==1, W==0), instruction
bits[7:0] are also not ARM architecture-defined, and can be used to specify
additional coprocessor options.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of
data-aborted instructions on page A2-17.
A4-83
ARM Instructions
4.1.42
STM(1)
31
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 P U 0 W 0
16 15
Rn
register_list
This form of the STM (Store Multiple) instruction stores a non-empty subset (or possibly all) of the
general-purpose registers to sequential memory locations.
Syntax
STM{<cond>}<addressing_mode>
<Rn>{!}, <registers>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined
in The condition field on page A3-5. If <cond> is omitted, the AL (always)
condition is used.
<addressing_mode>
Is described in Addressing Mode 4 - Load and Store Multiple on page A5-48. It
determines the P, U, and W bits of the instruction.
<Rn>
Sets the W bit, causing the instruction to write a modified value back to its base
register Rn as specified in Addressing Mode 4 - Load and Store Multiple on
page A5-48. If ! is omitted, the W bit is 0 and the instruction does not change its
base register in this way.
<registers>
Architecture version
All
Exceptions
Data Abort
A4-84
ARM Instructions
Operation
if ConditionPassed(cond) then
address = start_address
for i = 0 to 15
if register_list[i] == 1
Memory[address,4] = Ri
address = address + 4
assert end_address == address - 4
Usage
STM is useful as a block store instruction (combined with LDM it allows efficient block copy) and for stack
operations. A single STM used in the sequence of a procedure can push the return address and
general-purpose register values on to the stack, updating the stack pointer in the process.
Notes
Operand restrictions
If <Rn> is specified as <registers> and base register writeback is specified:
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Time order
The time order of the accesses to individual words of memory generated by this instruction
is only defined in some circumstances. See Data accesses to memory-mapped I/O on
page A2-32 for details.
A4-85
ARM Instructions
4.1.43
STM (2)
31
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 P U 1 0 0
16 15
Rn
register_list
This form of STM stores a subset (or possibly all) of the User mode general-purpose registers to sequential
memory locations.
Syntax
STM{<cond>}<addressing_mode>
<Rn>, <registers>^
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined
in The condition field on page A3-5. If <cond> is omitted, the AL (always)
condition is used.
<addressing_mode>
Is described in Addressing Mode 4 - Load and Store Multiple on page A5-48. It
determines the P and U bits of the instruction. Only the forms of this addressing
mode with W == 0 are available for this form of the STM instruction.
<Rn>
<registers>
For an STM instruction, indicates that User mode registers are to be stored.
Architecture version
All
Exceptions
Data Abort
A4-86
ARM Instructions
Operation
if ConditionPassed(cond) then
address = start_address
for i = 0 to 15
if register_list[i] == 1
Memory[address,4] = Ri_usr
address = address + 4
assert end_address == address - 4
Usage
STM is used to store the User mode registers when the processor is in a privileged mode (useful when
performing process swaps, and in instruction emulators).
Notes
Banked registers
Writeback
For the purpose of address calculation, the base register is read from the current
processor mode registers, not the User mode registers.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of
data-aborted instructions on page A2-17.
Time order
The time order of the accesses to individual words of memory generated by this
instruction is only defined in some circumstances. See Data accesses to
memory-mapped I/O on page A2-32 for details.
A4-87
ARM Instructions
4.1.44
STR
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I P U 0 W 0
16 15
Rn
12 11
Rd
addr_mode
The STR (Store Register) instruction stores a word from register <Rd> to the memory address calculated
by <addressing_mode>.
Syntax
STR{<cond>}
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the source register for the operation. If R15 is specified for <Rd>, the value stored
is IMPLEMENTATION DEFINED. For more details, see Reading the program counter on
page A2-7.
<addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, P, U, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
Memory[address,4] = Rd
Usage
Combined with a suitable addressing mode, STR stores 32-bit data from a general-purpose register into
memory. Using the PC as the base register allows PC-relative addressing, which facilitates
position-independent code.
A4-88
ARM Instructions
Notes
Operand restrictions
If <addressing_mode> specifies base register writeback, and the same register is
specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-89
ARM Instructions
4.1.45
STRB
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I P U 1 W 0
16 15
Rn
12 11
Rd
addr_mode
The STRB (Store Register Byte) instruction stores a byte from the least significant byte of register <Rd> to
the memory address calculated by <addressing_mode>.
Syntax
STR{<cond>}B
<Rd>, <addressing_mode>
where:
<cond>
<Rd>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Specifies the source register for the operation. If R15 is specified for <Rd>, the result is
UNPREDICTABLE.
<addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, P, U, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
Memory[address,1] = Rd[7:0]
Usage
Combined with a suitable addressing mode, STRB writes the least significant byte of a general-purpose
register to memory. Using the PC as the base register allows PC-relative addressing, which facilitates
position-independent code.
A4-90
ARM Instructions
Notes
Operand restrictions
If <addressing_mode> specifies base register writeback, and the same register is
specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-91
ARM Instructions
4.1.46
STRBT
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I 0 U 1 1 0
16 15
Rn
12 11
Rd
addr_mode
The STRBT (Store Register Byte with Translation) instruction stores a byte from the least significant byte
of register <Rd> to the memory address calculated by <post_indexed_addressing_mode>. If the
instruction is executed when the processor is in a privileged mode, the memory system is signaled to treat
the access as if the processor were in User mode.
Syntax
STR{<cond>}BT
<Rd>, <post_indexed_addressing_mode>
where:
<cond>
<Rd>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Specifies the source register for the operation. If R15 is specified for <Rd>, the result is
UNPREDICTABLE.
<post_indexed_addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, U, Rn and addr_mode bits of the instruction. Only post-indexed forms
of Addressing Mode 2 are available for this instruction. These forms have P == 0 and W ==
0, where P and W are bit[24] and bit[21] respectively. This instruction uses P == 0 and W
== 1 instead, but the addressing mode is the same in all other respects.
The syntax of all forms of <post_indexed_addressing_mode> includes a base
register <Rn>. All forms also specify that the instruction modifies the base register value
(this is known as base register writeback).
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
Memory[address,1] = Rd[7:0]
A4-92
ARM Instructions
Usage
STRBT can be used by a (privileged) exception handler that is emulating a memory access instruction which
would normally execute in User mode. The access is restricted as if it had User mode privilege.
Notes
User mode
If this instruction is executed in User mode, an ordinary User mode access is performed.
Operand restrictions
If the same register is specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
A4-93
ARM Instructions
4.1.47
STRH
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U I W 0
16 15
Rn
12 11
Rd
4 3
addr_mode 1 0 1 1 addr_mode
The STRH (Store Register Halfword) instruction stores a halfword from the least significant halfword of
register <Rd> to the memory address calculated by <addressing_mode>. If the address is not
halfword-aligned, the result is UNPREDICTABLE.
Syntax
STR{<cond>}H
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the source register for the operation. If R15 is specified for <Rd>, the result is
UNPREDICTABLE.
<addressing_mode>
Is described in Addressing Mode 3 - Miscellaneous Loads and Stores on page A5-34. It
determines the P, U, I, W, Rn and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
Architecture version
Version 4 and above
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
if address[0] == 0
data = Rd[15:0]
else /* address[0] == 1 */
data = UNPREDICTABLE
Memory[address,2] = data
A4-94
ARM Instructions
Usage
Combined with a suitable addressing mode, STRH allows 16-bit data from a general-purpose register to be
stored to memory. Using the PC as the base register allows PC-relative addressing, to facilitate
position-independent code.
Notes
Operand restrictions If <addressing_mode> specifies base register writeback, and the same register
is specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of
data-aborted instructions on page A2-17.
A4-95
ARM Instructions
4.1.48
STRT
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 I 0 U 0 1 0
16 15
Rn
12 11
Rd
addr_mode
The STRT (Store Register with Translation) instruction stores a word from register <Rd> to the memory
address calculated by <post_indexed_addressing_mode>. If the instruction is executed when
the processor is in a privileged mode, the memory system is signaled to treat the access as if the processor
was in User mode.
Syntax
STR{<cond>}T
<Rd>, <post_indexed_addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the source register for the operation. If R15 is specified for <Rd>, the value stored
is IMPLEMENTATION DEFINED. For more details, see Reading the program counter on
page A2-7.
<post_indexed_addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It determines the I, U, Rn and addr_mode bits of the instruction. Only post-indexed forms
of Addressing Mode 2 are available for this instruction. These forms have P == 0 and W ==
0, where P and W are bit[24] and bit[21] respectively. This instruction uses P == 0 and W
== 1 instead, but the addressing mode is the same in all other respects.
The syntax of all forms of <post_indexed_addressing_mode> includes a base
register <Rn>. All forms also specify that the instruction modifies the base register value
(this is known as base register writeback).
Architecture version
All
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
Memory[address,4] = Rd
A4-96
ARM Instructions
Usage
STRT can be used by a (privileged) exception handler that is emulating a memory access instruction that
would normally execute in User mode. The access is restricted as if it had User mode privilege.
Notes
User mode
If this instruction is executed in User mode, an ordinary User mode access is performed.
Operand restrictions
If the same register is specified for <Rd> and <Rn>, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
A4-97
ARM Instructions
4.1.49
SUB
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 0 0 1 0 S
16 15
Rn
12 11
Rd
shifter_operand
The SUB (Subtract) instruction subtracts the value of <shifter_operand> from the value of register
<Rn>, and stores the result in the destination register <Rd>. The condition code flags are optionally
updated, based on the result.
Syntax
SUB{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Sets the S bit (bit[20]) in the instruction to 1 and specifies that the instruction updates the
CPSR. If S is omitted, the S bit is set to 0 and the CPSR is not changed by the instruction.
Two types of CPSR update can occur when S is specified:
If <Rd> is not R15, the N and Z flags are set according to the result of the subtraction,
and the C and V flags are set according to whether the subtraction generated a borrow
(unsigned underflow) and a signed overflow, respectively. The rest of the CPSR is
unchanged.
If <Rd> is R15, the SPSR of the current mode is copied to the CPSR. This form of
the instruction is UNPREDICTABLE if executed in User mode or System mode, because
these modes do not have an SPSR.
<Rd>
<Rn>
Specifies the register that contains the first operand for the subtraction.
<shifter_operand>
Specifies the second operand for the subtraction. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not SUB.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
A4-98
ARM Instructions
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = Rn - shifter_operand
if S == 1 and Rd == R15 then
CPSR = SPSR
else if S == 1 then
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - shifter_operand)
V Flag = OverflowFrom(Rn - shifter_operand)
Usage
SUB is used to subtract one value from another to produce a third. To decrement a register value (in Rx) use:
SUBS Ri, Ri, #1
SUBS is useful as a loop counter decrement, as the loop branch can test the flags for the appropriate
termination condition, without the need for a compare instruction:
CMP Rx, #0
This both decrements the loop counter in Ri and checks whether it has reached zero.
The form of this instruction with the PC as its destination register and the S bit set can be used to return from
interrupts and various other types of exception. See Exceptions on page A2-13 for more details.
Notes
C flag
The SBC and RSC instructions use the C flag as a NOT(borrow) operand, performing
a normal subtraction if C == 1 and subtracting one more than usual if C == 0.
A4-99
ARM Instructions
4.1.50
SWI
31
28 27 26 25 24 23
cond
1 1 1 1
immed_24
The SWI (Software Interrupt) instruction causes a SWI exception (see Exceptions on page A2-13).
Syntax
SWI{<cond>}
<immed_24>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<immed_24> Is a 24-bit immediate value that is put into bits[23:0] of the instruction. This value is ignored
by the ARM processor, but can be used by an operating system SWI exception handler to
determine what operating system service is being requested (see Usage on page A4-101
below for more details).
Architecture version
All
Exceptions
Software interrupt
Operation
if ConditionPassed(cond) then
R14_svc
= address of next instruction after the SWI instruction
SPSR_svc = CPSR
CPSR[4:0] = 0b10011
/* Enter Supervisor mode */
CPSR[5]
= 0
/* Execute in ARM state */
/* CPSR[6] is unchanged */
CPSR[7]
= 1
/* Disable normal interrupts */
if high vectors configured then
PC
= 0xFFFF0008
else
PC
= 0x00000008
A4-100
ARM Instructions
Usage
The SWI instruction is used as an operating system service call. The method used to select which operating
system service is required is specified by the operating system, and the SWI exception handler for the
operating system determines and provides the requested service. Two typical methods are:
The 24-bit immediate in the instruction specifies which service is required, and any parameters
needed by the selected service are passed in general-purpose registers.
The 24-bit immediate in the instruction is ignored, general-purpose register R0 is used to select which
service is wanted, and any parameters needed by the selected service are passed in other
general-purpose registers.
A4-101
ARM Instructions
4.1.51
SWP
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 0 0
16 15
Rn
12 11
Rd
SBZ
4 3
1 0 0 1
Rm
The SWP (Swap) instruction swaps a word between registers and memory. SWP loads a word from the
memory address given by the value of register <Rn>. The value of register <Rm> is then stored to the
memory address given by the value of <Rn>, and the original loaded value is written to register <Rd>. If
the same register is specified for <Rd> and <Rm>, this instruction swaps the value of the register and
the value at the memory address.
Syntax
SWP{<cond>}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
<Rn>
Architecture version
Version 3 and above, plus version 2a
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
if Rn[1:0] == 0b00 then
temp = Memory[Rn,4]
else if Rn[1:0] == 0b01 then
temp = Memory[Rn,4] Rotate_Right 8
else if Rn[1:0] == 0b10 then
temp = Memory[Rn,4] Rotate_Right 16
else /* Rn[1:0] == 0b11 */
temp = Memory[Rn,4] Rotate_Right 24
Memory[Rn,4] = Rm
Rd = temp
A4-102
ARM Instructions
Usage
The SWP instruction can be used to implement semaphores. For sample code, see Semaphore instructions
on page A9-11.
Notes
Non word-aligned addresses
If the address is not word-aligned, the loaded value is rotated right by 8 times the
value of Rn[1:0]. The stored value is not rotated.
Use of R15
Operand restrictions If the same register is specified as <Rn> and <Rm>, or <Rn> and <Rd>, the result
is UNPREDICTABLE.
Data abort
If a data abort is signaled on either the load access or the store access, the loaded
value is not written to <Rd>. If a data abort is signaled on the load access, the store
access does not occur.
Alignment
A4-103
ARM Instructions
4.1.52
SWPB
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 1 0 0
16 15
Rn
12 11
Rd
SBZ
4 3
1 0 0 1
Rm
The SWPB (Swap Byte) instruction swaps a byte between registers and memory. SWPB loads a byte from
the memory address given by the value of register <Rn>. The value of the least significant byte of register
<Rm> is stored to the memory address given by <Rn>, the original loaded value is zero-extended to a 32-bit
word, and the word is written to register <Rd>. If the same register is specified for <Rd> and <Rm>, this
instruction swaps the value of the least significant byte of the register and the byte value at the memory
address.
Syntax
SWP{<cond>}B
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
<Rn>
Architecture version
Version 3 and above, plus version 2a
Exceptions
Data Abort
Operation
if ConditionPassed(cond) then
temp = Memory[Rn,1]
Memory[Rn,1] = Rm[7:0]
Rd = temp
Usage
The SWPB instruction can be used to implement semaphores, in a similar manner to that shown for SWP
instructions in Semaphore instructions on page A9-11.
A4-104
ARM Instructions
Notes
Use of R15
Operand restrictions If the same register is specified as <Rn> and <Rm>, or <Rn> and <Rd>, the result
is UNPREDICTABLE.
Data abort
If a data abort is signaled on either the load access or the store access, the loaded
value is not written to <Rd>. If a data abort is signaled on the load access, the store
access does not occur.
A4-105
ARM Instructions
4.1.53
TEQ
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 0 0 1 1
16 15
Rn
12 11
SBZ
shifter_operand
The TEQ (Test Equivalence) instruction compares a register value with another arithmetic value. The
condition flags are updated, based on the result of logically exclusive-ORing the two values, so that
subsequent instructions can be conditionally executed.
Syntax
TEQ{<cond>}
<Rn>, <shifter_operand>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rn>
Specifies the register that contains the first operand for the comparison.
<shifter_operand>
Specifies the second operand for the comparison. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option sets the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) in the instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not TEQ.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
Exceptions
None
Operation
if ConditionPassed(cond) then
alu_out = Rn EOR shifter_operand
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
Usage
TEQ is used to test if two values are equal, without affecting the V flag (as CMP does). The C flag is also
unaffected in many cases. TEQ is also useful for testing whether two values have the same sign. After the
comparison, the N flag is the logical Exclusive OR of the sign bits of the two operands.
A4-106
ARM Instructions
4.1.54
TST
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 I 1 0 0 0 1
16 15
Rn
12 11
SBZ
shifter_operand
The TST (Test) instruction compares a register value with another arithmetic value. The condition flags are
updated, based on the result of logically ANDing the two values, so that subsequent instructions can be
conditionally executed.
Syntax
TST{<cond>}
<Rn>, <shifter_operand>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rn>
Specifies the register that contains the first operand for the comparison.
<shifter_operand>
Specifies the second operand for the comparison. The options for this operand are described
in Addressing Mode 1 - Data-processing operands on page A5-2, including how each
option causes the I bit (bit[25]) and the shifter_operand bits (bits[11:0]) to be set in the
instruction.
If the I bit is 0 and both bit[7] and bit[4] of shifter_operand are 1, the instruction is not TST.
Instead, see Extending the instruction set on page A3-27 to determine which instruction it is.
Architecture version
All
Exceptions
None
Operation
if ConditionPassed(cond) then
alu_out = Rn AND shifter_operand
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = shifter_carry_out
V Flag = unaffected
A4-107
ARM Instructions
Usage
TST is used to determine whether a particular subset of register bits includes at least one set bit. A very
common use for TST is to test whether a single bit is set or clear.
A4-108
ARM Instructions
4.1.55
UMLAL
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 1 0 1 S
16 15
RdHi
12 11
RdLo
Rs
6 5
1 0 0 1
Rm
The UMLAL (Unsigned Multiply Accumulate Long) instruction multiplies the unsigned value of register
<Rm> with the unsigned value of register <Rs> to produce a 64-bit product. This product is added to the
64-bit value held in <RdHi> and <RdLo>, and the sum is written back to <RdHi> and <RdLo>. The
condition code flags are optionally updated, based on the result.
Syntax
UMLAL{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR by setting the N and Z flags according to the result of the
multiply-accumulate. If S is omitted, the S bit of the instruction is set to 0 and the entire
CPSR is unaffected by the instruction.
<RdLo>
Supplies the lower 32 bits of the value to be added to the product of <Rm> and <Rs>, and
is the destination register for the lower 32 bits of the result.
<RdHi>
Supplies the upper 32 bits of the value to be added to the product of <Rm> and <Rs>, and
is the destination register for the upper 32 bits of the result.
<Rm>
<Rs>
Architecture version
All M variants
Exceptions
None
A4-109
ARM Instructions
Operation
if ConditionPassed(cond) then
RdLo = (Rm * Rs)[31:0] + RdLo
/* Unsigned multiplication */
RdHi = (Rm * Rs)[63:32] + RdHi + CarryFrom((Rm * Rs)[31:0] + RdLo)
if S == 1 then
N Flag = RdHi[31]
Z Flag = if (RdHi == 0) and (RdLo == 0) then 1 else 0
C Flag = unaffected
/* See "C and V flags" note */
V Flag = unaffected
/* See "C and V flags" note */
Usage
UMLAL multiplies unsigned variables to produce a 64-bit result, which is added to the 64-bit value in the
two destination general-purpose registers. The result is written back to the two destination general-purpose
registers.
Notes
Use of R15
Operand restriction <RdHi>, <RdLo>, and <Rm> must be three distinct registers, or the results are
UNPREDICTABLE.
A4-110
Early termination
C and V flags
The UMLALS instruction is defined to leave the C and V flags unchanged in ARM
architecture version 5 and above. In earlier versions of the architecture, the values
of the C and V flags were UNPREDICTABLE after a UMLALS instruction.
ARM Instructions
4.1.56
UMULL
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 1 0 0 S
16 15
RdHi
12 11
RdLo
Rs
6 5
1 0 0 1
Rm
The UMULL (Unsigned Multiply Long) instruction multiplies the unsigned value of register <Rm> with the
unsigned value of register <Rs> to produce a 64-bit result. The upper 32 bits of the result are stored in
<RdHi>. The lower 32 bits are stored in <RdLo>. The condition code flags are optionally updated, based
on the 64-bit result.
Syntax
UMULL{<cond>}{S}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
Causes the S bit (bit[20]) in the instruction to be set to 1 and specifies that the instruction
updates the CPSR by setting the N and Z flags according to the result of the multiplication.
If S is omitted, the S bit of the instruction is set to 0 and the entire CPSR is unaffected by
the instruction.
<RdLo>
<RdHi>
<Rm>
<Rs>
Architecture version
All M variants
Exceptions
None
A4-111
ARM Instructions
Operation
if ConditionPassed(cond) then
RdHi = (Rm * Rs)[63:32]
/* Unsigned multiplication */
RdLo = (Rm * Rs)[31:0]
if S == 1 then
N Flag = RdHi[31]
Z Flag = if (RdHi == 0) and (RdLo == 0) then 1 else 0
C Flag = unaffected
/* See "C and V flags" note */
V Flag = unaffected
/* See "C and V flags" note */
Usage
UMULL multiplies unsigned variables to produce a 64-bit result in two general-purpose registers.
Notes
Use of R15
Operand restriction <RdHi>, <RdLo>, and <Rm> must be three distinct registers, or the results are
UNPREDICTABLE.
A4-112
Early termination
C and V flags
The UMULLS instruction is defined to leave the C and V flags unchanged in ARM
architecture version 5 and above. In earlier versions of the architecture, the values
of the C and V flags were UNPREDICTABLE after a UMULLS instruction.
ARM Instructions
4.2
v3, v3M
v4, v4xM
v4T, v4TxM
v5, v5xM,
v5T, v5TxM
v5TE,
v5TExP
ADC
Yes
Yes
Yes
Yes
Yes
ADD
Yes
Yes
Yes
Yes
Yes
AND
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
BIC
Yes
Yes
Yes
Yes
Yes
BKPT
No
No
No
Yes
Yes
BL
Yes
Yes
Yes
Yes
Yes
No
No
No
Yes
Yes
BX
No
No
Yes
Yes
Yes
CDP
Yes
Yes
Yes
Yes
Yes
CDP2
No
No
No
Yes
Yes
CLZ
No
No
No
Yes
Yes
CMN
Yes
Yes
Yes
Yes
Yes
CMP
Yes
Yes
Yes
Yes
Yes
EOR
Yes
Yes
Yes
Yes
Yes
LDC
Yes
Yes
Yes
Yes
Yes
LDC2
No
No
No
Yes
Yes
Yes
Yes
Yes
Yes
Yes
LDR
Yes
Yes
Yes
Yes
Yes
LDRB
Yes
Yes
Yes
Yes
Yes
LDRD
No
No
No
No
Only v5TE
LDRBT
Yes
Yes
Yes
Yes
Yes
A4-113
ARM Instructions
A4-114
Instruction
v3, v3M
v4, v4xM
v4T, v4TxM
v5, v5xM,
v5T, v5TxM
v5TE,
v5TExP
LDRH
No
Yes
Yes
Yes
Yes
LDRSB
No
Yes
Yes
Yes
Yes
LDRSH
No
Yes
Yes
Yes
Yes
LDRT
Yes
Yes
Yes
Yes
Yes
MCR
Yes
Yes
Yes
Yes
Yes
MCR2
No
No
No
Yes
Yes
MCRR
No
No
No
No
Only v5TE
MLA
Yes
Yes
Yes
Yes
Yes
MOV
Yes
Yes
Yes
Yes
Yes
MRC
Yes
Yes
Yes
Yes
Yes
MRC2
No
No
No
Yes
Yes
MRRC
No
No
No
No
Only v5TE
MRS
Yes
Yes
Yes
Yes
Yes
MSR
Yes
Yes
Yes
Yes
Yes
MUL
Yes
Yes
Yes
Yes
Yes
MVN
Yes
Yes
Yes
Yes
Yes
ORR
Yes
Yes
Yes
Yes
Yes
PLD
No
No
No
No
Only v5TE
QADD
No
No
No
No
Yes
QDADD
No
No
No
No
Yes
QDSUB
No
No
No
No
Yes
QSUB
No
No
No
No
Yes
RSB
Yes
Yes
Yes
Yes
Yes
RSC
Yes
Yes
Yes
Yes
Yes
ARM Instructions
v3, v3M
v4, v4xM
v4T, v4TxM
v5, v5xM,
v5T, v5TxM
v5TE,
v5TExP
SBC
Yes
Yes
Yes
Yes
Yes
SMLAL
Only v3M
Only v4
Only v4T
Only v5/v5T
Yes
SMLA<x><y>
No
No
No
No
Yes
SMLAL<x><y>
No
No
No
No
Yes
SMLAW<y>
No
No
No
No
Yes
SMULL
Only v3M
Only v4
Only v4T
Only v5/v5T
Yes
SMUL<x><y>
No
No
No
No
Yes
SMULW<y>
No
No
No
No
Yes
STC
Yes
Yes
Yes
Yes
Yes
STC2
No
No
No
Yes
Yes
Yes
Yes
Yes
Yes
Yes
STR
Yes
Yes
Yes
Yes
Yes
STRB
Yes
Yes
Yes
Yes
Yes
STRBT
Yes
Yes
Yes
Yes
Yes
STRD
No
No
No
No
Only v5TE
STRH
No
Yes
Yes
Yes
Yes
STRT
Yes
Yes
Yes
Yes
Yes
SUB
Yes
Yes
Yes
Yes
Yes
SWI
Yes
Yes
Yes
Yes
Yes
SWP
Yes
Yes
Yes
Yes
Yes
SWPB
Yes
Yes
Yes
Yes
Yes
TEQ
Yes
Yes
Yes
Yes
Yes
A4-115
ARM Instructions
A4-116
Instruction
v3, v3M
v4, v4xM
v4T, v4TxM
v5, v5xM,
v5T, v5TxM
v5TE,
v5TExP
TST
Yes
Yes
Yes
Yes
Yes
UMLAL
Only v3M
Only v4
Only v4T
Only v5/v5T
Yes
UMULL
Only v3M
Only v4
Only v4T
Only v5/v5T
Yes
Chapter A5
ARM Addressing Modes
This chapter describes each of the five addressing modes used with ARM instructions. The chapter contains
the following sections:
Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18
A5-1
5.1
#<immediate>
See Data-processing operands - Immediate on page A5-6.
2.
<Rm>
See Data-processing operands - Register on page A5-8.
3.
4.
5.
6.
7.
8.
9.
10.
11.
<Rm>, RRX
See Data-processing operands - Rotate right with extend on page A5-17.
A5-2
5.1.1
Encoding
The following diagrams show the encodings for this addressing mode:
32-bit immediate
31
28 27 26 25 24
cond
0 0 1
21 20 19
opcode
16 15
Rn
12 11
Rd
rotate_imm
immed_8
Immediate shifts
31
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
shift_imm
6 5
shift 0
Rm
Register shifts
31
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
Rs
6 5
0 shift 1
Rm
opcode
S bit
Rd
Rn
Bits[11:0]
The fields within bits[11:0] are collectively called a shifter operand. This is described in The
shifter operand on page A5-4.
Bit[25]
Is referred to as the I bit, and is used to distinguish between an immediate shifter operand
and a register-based shifter operand.
If all three of the following bits have the values shown, the instruction is not a data-processing instruction,
but lies in the arithmetic or Load/Store instruction extension space:
bit[25]
bit[4]
bit[7]
== 0
== 1
== 1
See Extending the instruction set on page A3-27 for more information.
A5-3
5.1.2
For example:
MOV
ADD
CMP
BIC
R0,
R3,
R7,
R9,
#0
R3, #1
#1000
R8, #0xFF00
;
;
;
;
Move zero to R0
Add one to the value of register 3
Compare value of R7 with 1000
Clear bits 8-15 of R8 and store in R9
R2, R0
R4, R3, R2
R7, R8
A5-4
ASR
LSL
LSR
ROR
Rotate right
RRX
The number of bits to shift by is specified either as an immediate or as the value of a register. For example:
MOV
ADD
RSB
SUB
MOV
R2,
R9,
R9,
R10,
R12,
R0,
R5,
R5,
R9,
R4,
LSL
R5,
R5,
R8,
ROR
#2
LSL #3
LSL #3
LSR #4
R3
;
;
;
;
;
A5-5
5.1.3
28 27 26 25 24
cond
0 0 1
21 20 19
opcode
16 15
Rn
12 11
Rd
rotate_imm
immed_8
This data-processing operand provides a constant (defined in the instruction) operand to a data-processing
instruction.
The shifter_operand value is formed by rotating (to the right) an 8-bit immediate value to any even
bit position in a 32-bit word. If the rotate immediate is zero, the carry-out from the shifter is the value of the
C flag, otherwise, it is set to bit[31] of the value of <shifter_operand>.
Syntax
#<immediate>
where:
<immediate>
Architecture version
All
Operation
shifter_operand = immed_8 Rotate_Right (rotate_imm * 2)
if rotate_imm == 0 then
shifter_carry_out = C flag
else /* rotate_imm != 0 */
shifter_carry_out = shifter_operand[31]
Notes
Legitimate immediates
Encoding
Not all 32-bit immediates are legitimate. Only those that can be formed by rotating an 8-bit
immediate right by an even amount are valid 32-bit immediates for this format.
Some values of <immediate> have more than one possible encoding. For example, a
value of 0x3F0 could be encoded as:
immed_8 == 0x3F, rotate_imm == 0xE
or as:
immed_8 == 0xFC, rotate_imm == 0xF
When more than one encoding is available, an assembler needs to choose the correct one to
use, as follows:
A5-6
For more precise control of the encoding, the instruction fields can be specified directly by
using the syntax:
#<immed_8>, <rotate_amount>
where <rotate_amount> = 2 * rotate_imm.
A5-7
5.1.4
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11 10 9 8
Rd
4 3
0 0 0 0 0 0 0 0
Rm
This data-processing operand provides the value of a register directly. The carry-out from the shifter is the
C flag.
Syntax
<Rm>
where:
<Rm>
Architecture version
All
Operation
shifter_operand = Rm
shifter_carry_out = C Flag
Notes
A5-8
Encoding
Use of R15
If R15 is specified as register Rm or Rn, the value used is the address of the current
instruction plus 8.
5.1.5
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
shift_imm
6 5
0 0 0
Rm
This data-processing operand is used to provide either the value of a register directly (lone register operand,
as described in Data-processing operands - Register on page A5-8), or the value of a register shifted left
(multiplied by a constant power of two).
This instruction operand is the value of register Rm, logically shifted left by an immediate value in the range
0 to 31. Zeros are inserted into the vacated bit positions. The carry-out from the shifter is the last bit shifted
out, or the C flag if no shift is specified.
Syntax
<Rm>, LSL #<shift_imm>
where:
<Rm>
LSL
<shift_imm>
Architecture version
All
Operation
if shift_imm == 0 then /* Register Operand */
shifter_operand = Rm
shifter_carry_out = C Flag
else /* shift_imm > 0 */
shifter_operand = Rm Logical_Shift_Left shift_imm
shifter_carry_out = Rm[32 - shift_imm]
Notes
Default shift
If the value of <shift_imm> == 0, the operand can be written as just <Rm> (see
Data-processing operands - Register on page A5-8).
Use of R15
If R15 is specified as register Rm or Rn, the value used is the address of the current
instruction plus 8.
A5-9
5.1.6
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
Rs
4 3
0 0 0 1
Rm
This data-processing operand is used to provide the value of a register multiplied by a variable power of two.
This instruction operand is the value of register Rm, logically shifted left by the value in the least significant
byte of register Rs. Zeros are inserted into the vacated bit positions. The carry-out from the shifter is the last
bit shifted out, which is zero if the shift amount is more than 32, or the C flag if the shift amount is zero.
Syntax
<Rm>, LSL <Rs>
where:
<Rm>
LSL
<Rs>
Architecture version
All
Operation
if Rs[7:0] == 0 then
shifter_operand = Rm
shifter_carry_out = C Flag
else if Rs[7:0] < 32 then
shifter_operand = Rm Logical_Shift_Left Rs[7:0]
shifter_carry_out = Rm[32 - Rs[7:0]]
else if Rs[7:0] == 32 then
shifter_operand = 0
shifter_carry_out = Rm[0]
else /* Rs[7:0] > 32 */
shifter_operand = 0
shifter_carry_out = 0
Notes
Use of R15
A5-10
Specifying R15 as register Rd, register Rm, register Rn, or register Rs has UNPREDICTABLE
results.
5.1.7
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
shift_imm
6 5
0 1 0
Rm
This data-processing operand is used to provide the unsigned value of a register shifted right (divided by a
constant power of two).
This instruction operand is the value of register Rm, logically shifted right by an immediate value in the
range 1 to 32. Zeros are inserted into the vacated bit positions. The carry-out from the shifter is the last bit
shifted out.
Syntax
<Rm>, LSR #<shift_imm>
where:
<Rm>
LSR
<shift_imm>
Specifies the shift. This is an immediate value between 1 and 32. (A shift by 32 is
encoded by shift_imm == 0.)
Architecture version
All
Operation
if shift_imm == 0 then
shifter_operand = 0
shifter_carry_out = Rm[31]
else /* shift_imm > 0 */
shifter_operand = Rm Logical_Shift_Right shift_imm
shifter_carry_out = Rm[shift_imm - 1]
Notes
Use of R15
If R15 is specified as register Rm or Rn, the value used is the address of the current
instruction plus 8.
A5-11
5.1.8
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
Rs
4 3
0 0 1 1
Rm
This data-processing operand is used to provide the unsigned value of a register shifted right (divided by a
variable power of two).
It is produced by the value of register Rm, logically shifted right by the value in the least significant byte of
register Rs. Zeros are inserted into the vacated bit positions. The carry-out from the shifter is the last bit
shifted out, which is zero if the shift amount is more than 32, or the C flag if the shift amount is zero.
Syntax
<Rm>, LSR <Rs>
where:
<Rm>
LSR
<Rs>
Architecture version
All
Operation
if Rs[7:0] == 0 then
shifter_operand = Rm
shifter_carry_out = C Flag
else if Rs[7:0] < 32 then
shifter_operand = Rm Logical_Shift_Right Rs[7:0]
shifter_carry_out = Rm[Rs[7:0] - 1]
else if Rs[7:0] == 32 then
shifter_operand = 0
shifter_carry_out = Rm[31]
else /* Rs[7:0] > 32 */
shifter_operand = 0
shifter_carry_out = 0
Notes
Use of R15
A5-12
Specifying R15 as register Rd, register Rm, register Rn, or register Rs has UNPREDICTABLE
results.
5.1.9
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
shift_imm
6 5
1 0 0
Rm
This data-processing operand is used to provide the signed value of a register arithmetically shifted right
(divided by a constant power of two).
This instruction operand is the value of register Rm, arithmetically shifted right by an immediate value in
the range 1 to 32. The sign bit of Rm (Rm[31]) is inserted into the vacated bit positions. The carry-out from
the shifter is the last bit shifted out.
Syntax
<Rm>, ASR #<shift_imm>
where:
<Rm>
ASR
<shift_imm>
Specifies the shift. This is an immediate value between 1 and 32. (A shift by 32 is
encoded by shift_imm == 0.)
Architecture version
All
Operation
if shift_imm == 0 then
if Rm[31] == 0 then
shifter_operand = 0
shifter_carry_out = Rm[31]
else /* Rm[31] == 1 */
shifter_operand = 0xFFFFFFFF
shifter_carry_out = Rm[31]
else /* shift_imm > 0 */
shifter_operand = Rm Arithmetic_Shift_Right <shift_imm>
shifter_carry_out = Rm[shift_imm - 1]
Notes
Use of R15
If R15 is specified as register Rm or Rn, the value used is the address of the current
instruction plus 8.
A5-13
5.1.10
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
Rs
7 6 5
0 1 0 1
Rm
This data-processing operand is used to provide the signed value of a register arithmetically shifted right
(divided by a variable power of two).
This instruction operand is the value of register Rm arithmetically shifted right by the value in the least
significant byte of register Rs. The sign bit of Rm (Rm[31]) is inserted into the vacated bit positions. The
carry-out from the shifter is the last bit shifted out, which is the sign bit of Rm if the shift amount is more
than 32, or the C flag if the shift amount is zero.
Syntax
<Rm>, ASR <Rs>
where:
<Rm>
ASR
<Rs>
Architecture version
All
Operation
if Rs[7:0] == 0 then
shifter_operand = Rm
shifter_carry_out = C Flag
else if Rs[7:0] < 32 then
shifter_operand = Rm Arithmetic_Shift_Right Rs[7:0]
shifter_carry_out = Rm[Rs[7:0] - 1]
else /* Rs[7:0] >= 32 */
if Rm[31] == 0 then
shifter_operand = 0
shifter_carry_out = Rm[31]
else /* Rm[31] == 1 */
shifter_operand = 0xFFFFFFFF
shifter_carry_out = Rm[31]
Notes
Use of R15
A5-14
Specifying R15 as register Rd, register Rm, register Rn, or register Rs has UNPREDICTABLE
results.
5.1.11
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
shift_imm
6 5
1 1 0
Rm
This data-processing operand is used to provide the value of a register rotated by a constant value.
This instruction operand is the value of register Rm rotated right by an immediate value in the range 1 to
31. As bits are rotated off the right end, they are inserted into the vacated bit positions on the left. The
carry-out from the shifter is the last bit rotated off the right end.
Syntax
<Rm>, ROR #<shift_imm>
where:
<Rm>
ROR
<shift_imm>
Specifies the rotation. This is an immediate value between 1 and 31. When
shift_imm == 0, an RRX operation (rotate right with extend) is performed. This is
described in Data-processing operands - Rotate right with extend on page A5-17.
Architecture version
All
Operation
if shift_imm == 0 then
See Data-processing operands - Rotate right with extend on page A5-17
else /* shift_imm > 0 */
shifter_operand = Rm Rotate_Right shift_imm
shifter_carry_out = Rm[shift_imm - 1]
Notes
Use of R15
If R15 is specified as register Rm or Rn, the value used is the address of the current
instruction plus 8.
A5-15
5.1.12
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11
Rd
Rs
4 3
0 1 1 1
Rm
This data-processing operand is used to provide the value of a register rotated by a variable value.
This instruction operand is produced by the value of register Rm rotated right by the value in the least
significant byte of register Rs. As bits are rotated off the right end, they are inserted into the vacated bit
positions on the left. The carry-out from the shifter is the last bit rotated off the right end, or the C flag if the
shift amount is zero.
Syntax
<Rm>, ROR <Rs>
where:
<Rm>
ROR
<Rs>
Architecture version
All
Operation
if Rs[7:0] == 0 then
shifter_operand = Rm
shifter_carry_out = C Flag
else if Rs[4:0] == 0 then
shifter_operand = Rm
shifter_carry_out = Rm[31]
else /* Rs[4:0] > 0 */
shifter_operand = Rm Rotate_Right Rs[4:0]
shifter_carry_out = Rm[Rs[4:0] - 1]
Notes
Use of R15
A5-16
Specifying R15 as register Rd, register Rm, register Rn, or register Rs has UNPREDICTABLE
results.
5.1.13
28 27 26 25 24
cond
0 0 0
21 20 19
opcode
16 15
Rn
12 11 10 9
Rd
7 6
4 3
0 0 0 0 0 1 1 0
Rm
This data-processing operand can be used to perform a 33-bit rotate right using the Carry Flag as the 33rd
bit.
This instruction operand is the value of register Rm shifted right by one bit, with the Carry Flag replacing
the vacated bit position. The carry-out from the shifter is the bit shifted off the right end.
Syntax
<Rm>, RRX
where:
<Rm>
RRX
Architecture version
All
Operation
shifter_operand = (C Flag Logical_Shift_Left 31) OR (Rm Logical_Shift_Right 1)
shifter_carry_out = Rm[0]
Notes
Encoding
The instruction encoding is in the space that would be used for ROR #0.
Use of R15
If R15 is specified as register Rm or Rn, the value used is the address of the current
instruction plus 8.
ADC instruction
A5-17
5.2
<Rd>, <addressing_mode>
[<Rn>, #+/-<offset_12>]
See Load and Store Word or Unsigned Byte - Immediate offset on page A5-20.
2.
[<Rn>, +/-<Rm>]
See Load and Store Word or Unsigned Byte - Register offset on page A5-21.
3.
4.
[<Rn>, #+/-<offset_12>]!
See Load and Store Word or Unsigned Byte - Immediate pre-indexed on page A5-24.
5.
[<Rn>, +/-<Rm>]!
See Load and Store Word or Unsigned Byte - Register pre-indexed on page A5-25.
6.
7.
[<Rn>], #+/-<offset_12>
See Load and Store Word or Unsigned Byte - Immediate post-indexed on page A5-28.
8.
[<Rn>], +/-<Rm>
See Load and Store Word or Unsigned Byte - Register post-indexed on page A5-30.
9.
A5-18
5.2.1
Encoding
The following three diagrams show the encodings for this addressing mode:
Immediate offset/index
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 0 P U B W L
16 15
Rn
12 11
Rd
offset_12
Register offset/index
31
28 27 26 25 24 23 22 21 20 19
cond
0 1 1 P U B W L
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
28 27 26 25 24 23 22 21 20 19
cond
The P bit
0 1 1 P U B W L
16 15
Rn
12 11
Rd
shift_imm
6 5
shift 0
Rm
Indicates the use of post-indexed addressing. The base register value is used for
the memory address, and the offset is then applied to the base register value and
written back to the base register.
P == 1
The U bit
Indicates whether the offset is added to the base (U == 1) or is subtracted from the base
(U == 0).
The B bit
The W bit
The L bit
P == 0
P == 1
A5-19
5.2.2
28 27 26 25 24 23 22 21 20 19
cond
0 1 0 1 U B 0 L
16 15
Rn
12 11
Rd
offset_12
This addressing mode calculates an address by adding or subtracting the value of an immediate offset to or
from the value of the base register Rn.
Syntax
[<Rn>, #+/-<offset_12>]
where:
<Rn>
<offset_12>
Specifies the immediate offset used with the value of Rn to form the address.
Architecture version
All
Operation
if U == 1 then
address = Rn + offset_12
else /* U == 0 */
address = Rn - offset_12
Usage
This addressing mode is useful for accessing structure (record) fields, and accessing parameters and local
variables in a stack frame. With an offset of zero, the address produced is the unaltered value of the base
register Rn.
Notes
Offset of zero The syntax [<Rn>] is treated as an abbreviation for [<Rn>, #0], unless the instruction
is one that only allows post-indexed addressing modes (LDRBT, LDRT, STRBT or STRT).
A5-20
The B bit
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
If R15 is specified as register Rn, the value used is the address of the instruction plus 8.
5.2.3
28 27 26 25 24 23 22 21 20 19
cond
0 1 1 1 U B 0 L
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
This addressing mode calculates an address by adding or subtracting the value of the index register Rm to
or from the value of the base register Rn.
Syntax
[<Rn>, +/-<Rm>]
where:
<Rn>
<Rm>
Specifies the register containing the value to add to or subtract from Rn.
Architecture version
All
Operation
if U == 1 then
address = Rn + Rm
else /* U == 0 */
address = Rn - Rm
Usage
This addressing mode is used for pointer plus offset arithmetic, and accessing a single element of an array
of bytes.
Notes
Encoding
This addressing mode is encoded as an LSL scaled register offset, scaled by zero.
The B bit
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
If R15 is specified as register Rn, the value used is the address of the instruction plus 8.
Specifying R15 as register Rm has UNPREDICTABLE results.
A5-21
5.2.4
28 27 26 25 24 23 22 21 20 19
cond
0 1 1 1 U B 0 L
16 15
Rn
12 11
Rd
shift_imm
4 3
shift 0
Rm
These five addressing modes calculate an address by adding or subtracting the shifted or rotated value of
the index register Rm to or from the value of the base register Rn.
Syntax
One of:
[<Rn>,
[<Rn>,
[<Rn>,
[<Rn>,
[<Rn>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
LSL #<shift_imm>]
LSR #<shift_imm>]
ASR #<shift_imm>]
ROR #<shift_imm>]
RRX]
where:
<Rn>
<Rm>
Specifies the register containing the offset to add to or subtract from Rn.
LSL
LSR
ASR
ROR
RRX
<shift_imm>
LSR
ASR
ROR
Architecture version
All
A5-22
Operation
case shift of
0b00 /* LSL */
index = Rm Logical_Shift_Left shift_imm
0b01 /* LSR */
if shift_imm == 0 then /* LSR #32 */
index = 0
else
index = Rm Logical_Shift_Right shift_imm
0b10 /* ASR */
if shift_imm == 0 then /* ASR #32 */
if Rm[31] == 1 then
index = 0xFFFFFFFF
else
index = 0
else
index = Rm Arithmetic_Shift_Right shift_imm
0b11 /* ROR or RRX */
if shift_imm == 0 then /* RRX */
index = (C Flag Logical_Shift_Left 31) OR
(Rm Logical_Shift_Right 1)
else /* ROR */
index = Rm Rotate_Right shift_imm
endcase
if U == 1 then
address = Rn + index
else /* U == 0 */
address = Rn - index
Usage
These addressing modes are used for accessing a single element of an array of values larger than a byte.
Notes
The B bit
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
If R15 is specified as register Rn, the value used is the address of the instruction plus 8.
Specifying R15 as register Rm has UNPREDICTABLE results.
A5-23
5.2.5
28 27 26 25 24 23 22 21 20 19
cond
0 1 0 1 U B 1 L
16 15
Rn
12 11
Rd
offset_12
This addressing mode calculates an address by adding or subtracting the value of an immediate offset to or
from the value of the base register Rn.
If the condition specified in the instruction matches the condition code status, the calculated address is
written back to the base register Rn. The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>, #+/-<offset_12>]!
where:
<Rn>
<offset_12>
Specifies the immediate offset used with the value of Rn to form the address.
Architecture version
All
Operation
if U == 1 then
address = Rn + offset_12
else /* if U == 0 */
address = Rn - offset_12
if ConditionPassed(cond) then
Rn = address
Usage
This addressing mode is used for pointer access to arrays with automatic update of the pointer value.
Notes
Offset of zero The syntax [<Rn>] must never be treated as an abbreviation for [<Rn>, #0]!.
A5-24
The B bit
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
5.2.6
28 27 26 25 24 23 22 21 20 19
cond
0 1 1 1 U B 1 L
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
This addressing mode calculates an address by adding or subtracting the value of an index register Rm to or
from the value of the base register Rn.
If the condition specified in the instruction matches the condition code status, the calculated address is
written back to the base register Rn. The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>, +/-<Rm>]!
where:
<Rn>
<Rm>
Specifies the register containing the offset to add to or subtract from Rn.
Architecture version
All
Operation
if U == 1 then
address = Rn + Rm
else /* U == 0 */
address = Rn - Rm
if ConditionPassed(cond) then
Rn = address
Notes
Encoding
This addressing mode is encoded as an LSL scaled register offset, scaled by zero.
The B bit
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
Operand restriction If the same register is specified for Rn and Rm, the result is UNPREDICTABLE.
A5-25
5.2.7
28 27 26 25 24 23 22 21 20 19
cond
0 1 1 1 U B 1 L
16 15
Rn
12 11
Rd
shift_imm
4 3
shift 0
Rm
These five addressing modes calculate an address by adding or subtracting the shifted or rotated value of
the index register Rm to or from the value of the base register Rn.
If the condition specified in the instruction matches the condition code status, the calculated address is
written back to the base register Rn. The conditions are defined in The condition field on page A3-5.
Syntax
One of:
[<Rn>,
[<Rn>,
[<Rn>,
[<Rn>,
[<Rn>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
LSL #<shift_imm>]!
LSR #<shift_imm>]!
ASR #<shift_imm>]!
ROR #<shift_imm>]!
RRX]!
where:
<Rn>
<Rm>
Specifies the register containing the offset to add to or subtract from Rn.
LSL
LSR
ASR
ROR
RRX
<shift_imm>
A5-26
LSL
LSR
ASR
ROR
Architecture version
All
Operation
case shift of
0b00 /* LSL */
index = Rm Logical_Shift_Left shift_imm
0b01 /* LSR */
if shift_imm == 0 then /* LSR #32 */
index = 0
else
index = Rm Logical_Shift_Right shift_imm
0b10 /* ASR */
if shift_imm == 0 then /* ASR #32 */
if Rm[31] == 1 then
index = 0xFFFFFFFF
else
index = 0
else
index = Rm Arithmetic_Shift_Right shift_imm
0b11 /* ROR or RRX */
if shift_imm == 0 then /* RRX */
index = (C Flag Logical_Shift_Left 31) OR
(Rm Logical_Shift_Right 1)
else /* ROR */
index = Rm Rotate_Right shift_imm
endcase
if U == 1 then
address = Rn + index
else /* U == 0 */
address = Rn - index
if ConditionPassed(cond) then
Rn = address
Notes
The B bit
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
Operand restriction If the same register is specified for Rn and Rm, the result is UNPREDICTABLE.
A5-27
5.2.8
28 27 26 25 24 23 22 21 20 19
cond
0 1 0 0 U B 0 L
16 15
Rn
12 11
Rd
offset_12
This addressing mode uses the value of the base register Rn as the address for the memory access.
If the condition specified in the instruction matches the condition code status, the value of the immediate
offset is added to or subtracted from the value of the base register Rn and written back to the base register
Rn. The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>], #+/-<offset_12>
where:
<Rn>
<offset_12>
Specifies the immediate offset used with the value of Rn to form the address.
Architecture version
All
Operation
address = Rn
if ConditionPassed(cond) then
if U == 1 then
Rn = Rn + offset_12
else /* U == 0 */
Rn = Rn - offset_12
Usage
This addressing mode is used for pointer access to arrays with automatic update of the pointer value.
A5-28
Notes
Post-indexed addressing modes
LDRBT, LDRT, STRBT, and STRT only support post-indexed addressing modes. They use
a minor modification of the above bit pattern, where bit[21] (the W bit) is 1, not 0 as shown.
Offset of zero The syntax [<Rn>] is treated as an abbreviation for [<Rn>],#0 for instructions that only
support post-indexed addressing modes (LDRBT, LDRT, STRBT, STRT), but not for other
instructions.
The B bit
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
A5-29
5.2.9
28 27 26 25 24 23 22 21 20 19
cond
0 1 1 0 U B 0 L
16 15
Rn
12 11 10 9 8
Rd
4 3
0 0 0 0 0 0 0 0
Rm
This addressing mode uses the value of the base register Rn as the address for the memory access.
If the condition specified in the instruction matches the condition code status, the value of the index register
Rm is added to or subtracted from the value of the base register Rn and written back to the base register Rn.
The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>], +/-<Rm>
where:
<Rn>
<Rm>
Specifies the register containing the offset to add to or subtract from Rn.
Architecture version
All
Operation
address = Rn
if ConditionPassed(cond) then
if U == 1 then
Rn = Rn + Rm
else /* U == 0 */
Rn = Rn - Rm
A5-30
Notes
Encoding
This addressing mode is encoded as an LSL scaled register offset, scaled by zero.
This bit distinguishes between an unsigned byte (B==1) and a word (B==0) access.
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
Use of R15
Operand restriction If the same register is specified for Rn and Rm, the result is UNPREDICTABLE.
A5-31
5.2.10
28 27 26 25 24 23 22 21 20 19
cond
0 1 1 0 U B 0 L
16 15
Rn
12 11
Rd
shift_imm
4 3
shift 0
Rm
This addressing mode uses the value of the base register Rn as the address for the memory access.
If the condition specified in the instruction matches the condition code status, the shifted or rotated value of
index register Rm is added to or subtracted from the value of the base register Rn and written back to the
base register Rn. The conditions are defined in The condition field on page A3-5.
Syntax
One of:
[<Rn>],
[<Rn>],
[<Rn>],
[<Rn>],
[<Rn>],
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
+/-<Rm>,
LSL
LSR
ASR
ROR
RRX
#<shift_imm>
#<shift_imm>
#<shift_imm>
#<shift_imm>
where:
A5-32
<Rn>
<Rm>
Specifies the register containing the offset to add to or subtract from Rn.
LSL
LSR
ASR
ROR
RRX
<shift_imm>
LSR
ASR
ROR
Architecture version
All
Operation
address = Rn
case shift of
0b00 /* LSL */
index = Rm Logical_Shift_Left shift_imm
0b01 /* LSR */
if shift_imm == 0 then /* LSR #32 */
index = 0
else
index = Rm Logical_Shift_Right shift_imm
0b10 /* ASR */
if shift_imm == 0 then /* ASR #32 */
if Rm[31] == 1 then
index = 0xFFFFFFFF
else
index = 0
else
index = Rm Arithmetic_Shift_Right shift_imm
0b11 /* ROR or RRX */
if shift_imm == 0 then /* RRX */
index = (C Flag Logical_Shift_Left 31) OR
(Rm Logical_Shift_Right 1)
else /* ROR */
index = Rm Rotate_Right shift_imm
endcase
if ConditionPassed(cond) then
if U == 1 then
Rn = Rn + index
else /* U == 0 */
Rn = Rn - index
Notes
Post-indexed addressing modes
LDRBT, LDRT, STRBT, and STRT only support post-indexed addressing modes.
They use a minor modification of the above bit pattern, where bit[21] (the W bit) is
1, not 0 as shown.
The B bit
The L bit
Use of R15
Operand restriction If the same register is specified for Rn and Rm, the result is UNPREDICTABLE.
A5-33
5.3
<Rd>, <addressing_mode>
[<Rn>, #+/-<offset_8>]
See Miscellaneous Loads and Stores - Immediate offset on page A5-36.
2.
[<Rn>, +/-<Rm>]
See Miscellaneous Loads and Stores - Register offset on page A5-38.
3.
[<Rn>, #+/-<offset_8>]!
See Miscellaneous Loads and Stores - Immediate pre-indexed on page A5-40.
4.
[<Rn>, +/-<Rm>]!
See Miscellaneous Loads and Stores - Register pre-indexed on page A5-42.
5.
[<Rn>], #+/-<offset_8>
See Miscellaneous Loads and Stores - Immediate post-indexed on page A5-44.
6.
[<Rn>], +/-<Rm>
See Miscellaneous Loads and Stores - Register post-indexed on page A5-46.
5.3.1
Encoding
The following diagrams show the encodings for this addressing mode:
Immediate offset/index
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U 1 W L
16 15
Rn
12 11
Rd
immedH
4 3
1 S H 1
ImmedL
Register offset/index
31
28 27 26 25 24 23 22 21 20 19
cond
A5-34
0 0 0 P U 0 W L
16 15
Rn
12 11
Rd
SBZ
4 3
1 S H 1
Rm
The P bit
Indicates the use of post-indexed addressing. The base register value is used for
the memory address, and the offset is then applied to the base register value and
written back to the base register.
P == 1
The U bit
Indicates whether the offset is added to the base (U == 1) or subtracted from the base
(U == 0).
The W bit
P == 1
W == 1 indicates that the memory address is written back to the base register
(pre-indexed addressing), and W == 0 that the base register is unchanged (offset
addressing).
The L bit
The S bit
The H bit
Unsigned bytes
If S == 0 and H == 0, apparently indicating an unsigned byte, the instruction is not one that
uses this addressing mode. Instead, it is a multiply instruction, a SWP or SWPB instruction,
or an unallocated instruction in the arithmetic or load/store instruction extension space (see
Extending the instruction set on page A3-27).
Unsigned bytes are accessed by the LDRB, LDRBT, STRB and STRBT instructions, which
use addressing mode 2 rather than addressing mode 3.
Signed stores If S == 1 and L == 0, apparently indicating a signed store instruction, the instruction is an
unallocated instruction in the load/store extension space (see Extending the instruction set
on page A3-27).
Signed bytes and halfwords can be stored with the same STRB and STRH instructions as are
used for unsigned quantities, so no separate signed store instructions are provided.
A5-35
5.3.2
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 U 1 0 L
16 15
Rn
12 11
Rd
immedH
4 3
1 S H 1
immedL
This addressing mode calculates an address by adding or subtracting the value of an immediate offset to or
from the value of the base register Rn.
Syntax
[<Rn>, #+/-<offset_8>]
where:
<Rn>
<offset_8>
Specifies the immediate offset used with the value of Rn to form the address. The
offset is encoded in immedH (top 4 bits) and immedL (bottom 4 bits).
Architecture version
Version 4 and above
Operation
offset_8 = (immedH << 4) OR immedL
if U == 1 then
address = Rn + offset_8
else /* U == 0 */
address = Rn - offset_8
Usage
This addressing mode is used for accessing structure (record) fields, and accessing parameters and locals
variable in a stack frame. With an offset of zero, the address produced is the unaltered value of the base
register Rn.
Notes
A5-36
Zero offset
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
The S bit
This bit distinguishes between a signed (S==1) and an unsigned (S==0) halfword access.
The H bit
This bit distinguishes between a halfword (H==1) and a signed byte (H==0) access.
Use of R15
If R15 is specified as register Rn, the value used is the address of the instruction plus 8.
Unsigned bytes
If S == 0 and H == 0, apparently indicating an unsigned byte, the instruction is not one that
uses this addressing mode. Instead, it is a multiply instruction, a SWP or SWPB instruction,
or an unallocated instruction in the arithmetic or load/store instruction extension space (see
Extending the instruction set on page A3-27).
Unsigned bytes are accessed by the LDRB, LDRBT, STRB and STRBT instructions, which
use addressing mode 2 rather than addressing mode 3.
Signed stores If S == 1 and L == 0, apparently indicating a signed store instruction, the instruction is an
unallocated instruction in the load/store extension space (see Extending the instruction set
on page A3-27).
Signed bytes and halfwords can be stored with the same STRB and STRH instructions as are
used for unsigned quantities, so no separate signed store instructions are provided.
A5-37
5.3.3
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 U 0 0 L
16 15
Rn
12 11
Rd
SBZ
4 3
1 S H 1
Rm
This addressing mode calculates an address by adding or subtracting the value of the index register Rm to
or from the value of the base register Rn.
Syntax
[<Rn>, +/-<Rm>]
where:
<Rn>
<Rm>
Architecture version
Version 4 and above
Operation
if U == 1 then
address = Rn + Rm
else /* U == 0 */
address = Rn - Rm
Usage
This addressing mode is useful for pointer plus offset arithmetic and for accessing a single element of an
array.
Notes
The L bit
The S bit
The H bit
This bit distinguishes between a halfword (H==1) and a signed byte (H==0) access.
Unsigned bytes
A5-38
Signed stores
Use of R15
If R15 is specified as register Rn, the value used is the address of the instruction plus
8. Specifying R15 as register Rm has UNPREDICTABLE results.
A5-39
5.3.4
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 U 1 1 L
16 15
Rn
12 11
Rd
immedH
4 3
1 S H 1
ImmedL
This addressing mode calculates an address by adding or subtracting the value of an immediate offset to or
from the value of the base register Rn.
If the condition specified in the instruction matches the condition code status, the calculated address is
written back to the base register Rn. The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>, #+/-<offset_8>]!
where:
<Rn>
<offset_8>
Specifies the immediate offset used with the value of Rn to form the address. The
offset is encoded in immedH (top 4 bits) and immedL (bottom 4 bits).
Architecture version
Version 4 and above
Operation
offset_8 = (immedH << 4) OR immedL
if U == 1 then
address = Rn + offset_8
else /* U == 0 */
address = Rn - offset_8
if ConditionPassed(cond) then
Rn = address
Usage
This addressing mode gives pointer access to arrays, with automatic update of the pointer value.
A5-40
Notes
Offset of zero
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
The S bit
This bit distinguishes between a signed (S==1) and an unsigned (S==0) halfword
access.
The H bit
This bit distinguishes between a halfword (H==1) and a signed byte (H==0) access.
Unsigned bytes
Signed stores
Use of R15
A5-41
5.3.5
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 U 0 1 L
16 15
Rn
12 11
Rd
SBZ
4 3
1 S H 1
Rm
This addressing mode calculates an address by adding or subtracting the value of the index register Rm to
or from the value of the base register Rn.
If the condition specified in the instruction matches the condition code status, the calculated address is
written back to the base register Rn. The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>, +/-<Rm>]!
where:
<Rn>
<Rm>
Specifies the register containing the offset to add to or subtract from Rn.
Architecture version
Version 4 and above
Operation
if U == 1 then
address = Rn + Rm
else /* U == 0 */
address = Rn - Rm
if ConditionPassed(cond) then
Rn = address
A5-42
Notes
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
The S bit
This bit distinguishes between a signed (S==1) and an unsigned (S==0) halfword
access.
The H bit
This bit distinguishes between a halfword (H==1) and a signed byte (H==0) access.
Unsigned bytes
Signed stores
Use of R15
Operand restriction If the same register is specified for Rn and Rm, the result is UNPREDICTABLE.
A5-43
5.3.6
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 U 1 0 L
16 15
Rn
12 11
Rd
immedH
4 3
1 S H 1
ImmedL
This addressing mode uses the value of the base register Rn as the address for the memory access.
If the condition specified in the instruction matches the condition code status, the value of the immediate
offset is added to or subtracted from the value of the base register Rn and written back to the base
register Rn. The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>], #+/-<offset_8>
where:
<Rn>
<offset_8>
Specifies the immediate offset used with the value of Rn to form the address. The
offset is encoded in immedH (top 4 bits) and immedL (bottom 4 bits).
Architecture version
Version 4 and above
Operation
address = Rn
offset_8 = (immedH << 4) OR immedL
if ConditionPassed(cond) then
if U == 1 then
Rn = Rn + offset_8
else /* U == 0 */
Rn = Rn - offset_8
Usage
This addressing mode gives pointer access to arrays, with automatic update of the pointer value.
A5-44
Notes
Offset of zero
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
The S bit
This bit distinguishes between a signed (S==1) and an unsigned (S==0) halfword
access.
The H bit
This bit distinguishes between a halfword (H==1) and a signed byte (H==0) access.
Unsigned bytes
Signed stores
Use of R15
A5-45
5.3.7
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 0 U 0 0 L
16 15
Rn
12 11
Rd
SBZ
4 3
1 S H 1
Rm
This addressing mode uses the value of the base register Rn as the address for the memory access.
If the condition specified in the instruction matches the condition code status, the value of the index register
Rm is added to or subtracted from the value of the base register Rn and written back to the base register Rn.
The conditions are defined in The condition field on page A3-5.
Syntax
[<Rn>], +/-<Rm>
where:
<Rn>
<Rm>
Specifies the register containing the offset to add to or subtract from Rn.
Architecture version
Version 4 and above
Operation
address = Rn
if ConditionPassed(cond) then
if U == 1 then
Rn = Rn + Rm
else /* U == 0 */
Rn = Rn - Rm
A5-46
Notes
The L bit
This bit distinguishes between a Load (L==1) and a Store (L==0) instruction.
The S bit
This bit distinguishes between a signed (S==1) and an unsigned (S==0) halfword
access.
The H bit
This bit distinguishes between a halfword (H==1) and a signed byte (H==0) access.
Unsigned bytes
Signed stores
Use of R15
Operand restriction If the same register is specified for Rn and Rm, the result is UNPREDICTABLE.
A5-47
5.4
IA (Increment After)
See Load and Store Multiple - Increment after on page A5-50.
2.
IB (Increment Before)
See Load and Store Multiple - Increment before on page A5-51.
3.
DA (Decrement After)
See Load and Store Multiple - Decrement after on page A5-52.
4.
DB (Decrement Before)
See Load and Store Multiple - Decrement before on page A5-53.
5.4.1
Encoding
The following diagram shows the encoding for this addressing mode:
31
28 27 26 25 24 23 22 21 20 19
cond
The P bit
The U bit
A5-48
1 0 0 P U S W L
16 15
Rn
register list
P==0
indicates that the word addressed by Rn is excluded from the range of memory
locations accessed, and lies one word beyond the top of the range (U==0) or one
word below the bottom of the range (U==1).
Indicates that the transfer is made upwards (U==1) or downwards (U==0) from the base
register.
The S bit
For LDMs that load the PC, the S bit indicates that the CPSR is loaded from the SPSR. For
LDMs that do not load the PC and all STMs, the S bit indicates that when the processor is in
a privileged mode, the User mode banked registers are transferred instead of the registers of
the current mode.
The W bit
Indicates that the base register is updated after the transfer. The base register is incremented
(U==1) or decremented (U==0) by four times the number of registers in the register list.
The L bit
Register list
The register_list field of the instruction has one bit for each general-purpose register: bit[0]
for register zero through to bit[15] for register 15 (the PC). If no bits are set, the result is
UNPREDICTABLE.
The instruction syntax specifies the registers to load or store in <registers>, which is a
comma-separated list of registers, surrounded by { and }.
A5-49
5.4.2
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 0 1 S W L
16 15
Rn
register list
This addressing mode is for Load and Store Multiple instructions, and forms a range of addresses.
The first address formed is the <start_address>, and is the value of the base register Rn. Subsequent
addresses are formed by incrementing the previous address by four. One address is produced for each
register that is specified in <registers>.
The last address produced is the <end_address>. Its value is four less than the sum of the value of the
base register and four times the number of registers specified in <registers>.
If the condition specified in the instruction matches the condition code status and the W bit is set, Rn is
incremented by four times the number of registers in <registers>. The conditions are defined in The
condition field on page A3-5.
Syntax
IA
See also the alternative syntax described in Load and Store Multiple addressing modes (alternative names)
on page A5-54.
Architecture version
All
Operation
start_address = Rn
end_address = Rn + (Number_Of_Set_Bits_In(register_list) * 4) - 4
if ConditionPassed(cond) and W == 1 then
Rn = Rn + (Number_Of_Set_Bits_In(register_list) * 4)
Notes
A5-50
The L bit
The S bit
For LDMs that load the PC, the S bit indicates that the CPSR is loaded from the SPSR. For
LDMs that do not load the PC and all STMs, the S bit indicates that when the processor is in
a privileged mode, the User mode banked registers are transferred instead of the registers of
the current mode.
5.4.3
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 1 1 S W L
16 15
Rn
register list
This addressing mode is for Load and Store Multiple instructions, and forms a range of addresses.
The first address formed is the <start_address>, and is the value of the base register Rn plus four.
Subsequent addresses are formed by incrementing the previous address by four. One address is produced
for each register that is specified in <registers>.
The last address produced is the <end_address>. Its value is the sum of the value of the base register
and four times the number of registers specified in <registers>.
If the condition specified in the instruction matches the condition code status and the W bit is set, Rn is
incremented by four times the number of registers in <registers>. The conditions are defined in The
condition field on page A3-5.
Syntax
IB
See also the alternative syntax described in Load and Store Multiple addressing modes (alternative names)
on page A5-54.
Architecture version
All
Operation
start_address = Rn + 4
end_address = Rn + (Number_Of_Set_Bits_In(register_list) * 4)
if ConditionPassed(cond) and W == 1 then
Rn = Rn + (Number_Of_Set_Bits_In(register_list) * 4)
Notes
The L bit
The S bit
For LDMs that load the PC, the S bit indicates that the CPSR is loaded from the SPSR. For
LDMs that do not load the PC and all STMs, the S bit indicates that when the processor is in
a privileged mode, the User mode banked registers are transferred instead of the registers of
the current mode.
A5-51
5.4.4
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 0 0 S W L
16 15
Rn
register list
This addressing mode is for Load and Store Multiple instructions, and forms a range of addresses.
The first address formed is the <start_address>, and is the value of the base register minus four times
the number of registers specified in <registers>, plus 4. Subsequent addresses are formed by
incrementing the previous address by four. One address is produced for each register that is specified in
<registers>.
The last address produced is the <end_address>. Its value is the value of the base register Rn.
If the condition specified in the instruction matches the condition code status and the W bit is set, Rn is
decremented by four times the number of registers in <registers>. The conditions are defined in The
condition field on page A3-5.
Syntax
DA
See also the alternative syntax described in Load and Store Multiple addressing modes (alternative names)
on page A5-54.
Architecture version
All
Operation
start_address = Rn - (Number_Of_Set_Bits_In(register_list) * 4) + 4
end_address = Rn
if ConditionPassed(cond) and W == 1 then
Rn = Rn - (Number_Of_Set_Bits_In(register_list) * 4)
Notes
A5-52
The L bit
The S bit
For LDMs that load the PC, the S bit indicates that the CPSR is loaded from the SPSR. For
LDMs that do not load the PC and all STMs, the S bit indicates that when the processor is in
a privileged mode, the User mode banked registers are transferred instead of the registers of
the current mode.
5.4.5
28 27 26 25 24 23 22 21 20 19
cond
1 0 0 1 0 S W L
16 15
Rn
register list
This addressing mode is for Load and Store multiple instructions, and forms a range of addresses.
The first address formed is the <start_address>, and is the value of the base register minus four times
the number of registers specified in <registers>. Subsequent addresses are formed by incrementing the
previous address by four. One address is produced for each register that is specified in <registers>.
The last address produced is the <end_address>. Its value is the value of the base register Rn minus four.
If the condition specified in the instruction matches the condition code status and the W bit is set, Rn is
decremented by four times the number of registers in <registers>. The conditions are defined in The
condition field on page A3-5.
Syntax
DB
See also the alternative syntax described in Load and Store Multiple addressing modes (alternative names)
on page A5-54.
Architecture version
All
Operation
start_address = Rn - (Number_Of_Set_Bits_In(register_list) * 4)
end_address = Rn - 4
if ConditionPassed(cond) and W == 1 then
Rn = Rn - (Number_Of_Set_Bits_In(register_list) * 4)
Notes
The L bit
The S bit
For LDMs that load the PC, the S bit indicates that the CPSR is loaded from the SPSR. For
LDMs that do not load the PC and all STMs, the S bit indicates that when the processor is in
a privileged mode, the User mode banked registers are transferred instead of the registers of
the current mode.
A5-53
5.4.6
Stack operations
Load Multiple and Store Multiple addressing modes can be specified with an alternative syntax, which is
more applicable to stack operations:
Full stacks
Have stack pointers that point to the last used (full) location.
Empty stacks
Have stack pointers that point to the first unused (empty) location.
Descending stacks
Ascending stacks
Note
When defining stacks on which coprocessor data is to be placed (or might be placed in the future),
programmers are advised to use the FD or EA stack types. This is because coprocessor data can be pushed
to these types of stack with a single STC instruction and popped from them with a single LDC instruction.
Multi-instruction sequences are required for coprocessor access to FA or ED stacks.
Table 5-1 and Table 5-2 on page A5-55 show the relationship between the four types of stack, the four types
of addressing mode shown above, and the L, U, and P bits in the instruction format.
A5-54
L bit
P bit
U bit
L bit
P bit
U bit
A5-55
5.5
<coproc>, <CRd>,<addressing_mode>
[<Rn>,#+/-<offset_8>*4]
See Load and Store Coprocessor - Immediate offset on page A5-58.
2.
[<Rn>,#+/-<offset_8>*4]!
See Load and Store Coprocessor - Immediate pre-indexed on page A5-60.
3.
[<Rn>], #+/-<offset_8>*4
See Load and Store Coprocessor - Immediate post-indexed on page A5-62.
4.
[<Rn>],<option>
See Load and Store Coprocessor - Unindexed on page A5-64.
5.5.1
Encoding
The following diagram shows the encoding for this addressing mode:
31
28 27 26 25 24 23 22 21 20 19
cond
The P bit
A5-56
1 1 0 P U N W L
16 15
Rn
12 11
CRd
cp#
offset_8
P == 0
The U bit
The N bit
The W bit
Also:
The L bit
A5-57
5.5.2
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 1 U N 0 L
16 15
Rn
12 11
CRd
cp_num
offset_8
This addressing mode produces a sequence of consecutive addresses. The first address is calculated by
adding or subtracting four times the value of an immediate offset to or from the value of the base register
Rn. The subsequent addresses in the sequence are produced by incrementing the previous address by four
until the coprocessor signals the end of the instruction. This allows a coprocessor to access data whose size
is coprocessor-defined.
The coprocessor must not request a transfer of more than 16 words.
Syntax
[<Rn>, #+/-<offset_8>*4]
where:
<Rn>
<offset_8>
Architecture version
Version 2 and above
Operation
if ConditionPassed(cond) then
if U == 1 then
address = Rn + offset_8 * 4
else /* U == 0 */
address = Rn - offset_8 * 4
start_address = address
while (NotFinished(coprocessor[cp_num]))
address = address + 4
end_address = address
A5-58
Notes
The N bit
Is coprocessor-dependent.
The L bit
Use of R15
If R15 is specified as register Rn, the value used is the address of the instruction plus 8.
A5-59
5.5.3
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 1 U N 1 L
16 15
Rn
12 11
CRd
cp_num
offset_8
This addressing mode produces a sequence of consecutive addresses. The first address is calculated by
adding or subtracting four times the value of an immediate offset to or from the value of the base register
Rn. If the condition specified in the instruction matches the condition code status, the first address is written
back to the base register Rn. The subsequent addresses in the sequence are produced by incrementing the
previous address by four until the coprocessor signals the end of the instruction. This allows a coprocessor
to access data whose size is coprocessor-defined.
The coprocessor must not request a transfer of more than 16 words.
Syntax
[<Rn>, #+/-<offset_8>*4]!
where:
<Rn>
<offset_8>
Architecture version
Version 2 and above
Operation
if ConditionPassed(cond) then
if U == 1 then
Rn = Rn + offset_8 * 4
else /* U == 0 */
Rn = Rn - offset_8 * 4
start_address = Rn
address = start_address
while (NotFinished(coprocessor[cp_num]))
address = address + 4
end_address = address
A5-60
Notes
The N bit
Is coprocessor-dependent.
The L bit
Use of R15
A5-61
5.5.4
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 0 U N 1 L
16 15
Rn
12 11
CRd
cp_num
offset_8
This addressing mode produces a sequence of consecutive addresses. The first address is the value of the
base register Rn. The subsequent addresses in the sequence are produced by incrementing the previous
address by four until the coprocessor signals the end of the instruction. This allows a coprocessor to access
data whose size is coprocessor-defined.
If the condition specified in the instruction matches the condition code status, the base register Rn is updated
by adding or subtracting four times the value of an immediate offset to or from the value of the base register
Rn.
The coprocessor must not request a transfer of more than 16 words.
Syntax
[<Rn>], #+/-<offset_8>*4
where:
<Rn>
<offset_8>
Architecture version
Version 2 and above
Operation
if ConditionPassed(cond) then
start_address = Rn
if U == 1 then
Rn = Rn + offset_8 * 4
else /* U == 0 */
Rn = Rn - offset_8 * 4
address = start_address
while (NotFinished(coprocessor[cp_num]))
address = address + 4
end_address = address
A5-62
Notes
The N bit
Is coprocessor-dependent.
The L bit
Use of R15
A5-63
5.5.5
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 0 U N 0 L
16 15
Rn
12 11
CRd
cp_num
option
This addressing mode produces a sequence of consecutive addresses. The first address is the value of the
base register Rn. The subsequent addresses in the sequence are produced by incrementing the previous
address by four until the coprocessor signals the end of the instruction. This allows a coprocessor to access
data whose size is coprocessor-defined.
The base register Rn is not updated. Bits[7:0] of the instruction are therefore not used by the ARM, either
for the address calculation or to calculate a new value for the base register, and so can be used to specify
additional instruction options to the coprocessor.
The coprocessor must not request a transfer of more than 16 words.
Syntax
[<Rn>], <option>
where:
<Rn>
<option>
Architecture version
Version 2 and above
Operation
if ConditionPassed(cond) then
start_address = Rn
address = start_address
while (NotFinished(coprocessor[cp_num]))
address = address + 4
end_address = address
A5-64
Notes
The N bit
Is coprocessor-dependent.
The L bit
Use of R15
If R15 is specified as register Rn, the value used is the address of the instruction plus 8.
The U bit
If bit[23] (the Up/down bit) is not set, the result is either UNDEFINED or UNPREDICTABLE (see
Coprocessor instruction extension space on page A3-33).
Option bits
Are unused by the ARM in this addressing mode, and therefore can be used to request
additional instruction options in a coprocessor-dependent fashion.
A5-65
A5-66
Chapter A6
The Thumb Instruction Set
This chapter introduces the Thumb instruction set and describes how Thumb uses the ARM programmers
model. It contains the following sections:
A6-1
6.1
32-bit instructions are fetched (and the PC is incremented by four) and are executed as ARM
instructions.
T == 1
16-bit instructions are fetched (and the PC is incremented by two) and are executed as
Thumb instructions.
Note
The Thumb instruction set is only compatible with the 32-bit ARM architectures. Thumb is not
recommended for use with 26-bit architectures or with 26-bit compatibility options on 32-bit architectures.
6.1.1
A6-2
6.1.2
Exceptions
Exceptions generated during Thumb execution switch to ARM execution before executing the exception
handler (whose first instruction is at the hardware vector). The state of the T bit is preserved in the SPSR,
and the LR of the exception mode is set so that the normal return instruction performs correctly, regardless
of whether the exception occurred during ARM or Thumb execution. Table 6-1 lists the values of the
exception mode LR for exceptions generated during Thumb execution.
Table 6-1 Exception return instructions
Exception
Reset
UNPREDICTABLE
Undefined
SWI
Prefetch Abort
Data Abort
IRQ
FIQ
value
Return instruction
-
Note
For each exception, the return instruction indicated by Table 6-1 is the same as the return instruction
required if the exception occurred during ARM execution, for the primary or only method of return from
that instruction listed in Exceptions on page A2-13. However, the following two types of exception have a
secondary return method, for which different return instructions are needed depending on whether the
exception occurred during ARM or Thumb execution:
For the Data Abort exception, the primary method of return causes execution to resume at the aborted
instruction, which causes it to be re-executed. As described in Data Abort (data access memory
abort) on page A2-17, it is also possible to return to the next instruction after the aborted instruction,
using a SUBS PC,R14,#4 instruction. If this type of return is required for a data abort caused by
a Thumb instruction, use SUBS PC,R14,#6 for the return instruction.
For the Undefined Instruction exception, the primary method of return causes execution to resume at
the next instruction after the undefined instruction. As described in Undefined Instruction exception
on page A2-15, it is also possible to return to the undefined instruction itself, using the instruction
SUBS PC,R14,#4. If this type of return is required for a Thumb undefined instruction, use SUBS
PC,R14,#2 for the return instruction. However, the main use of this type of return is for some types
of coprocessor instruction, and as the Thumb instruction set does not contain any coprocessor
instructions, you are unlikely to need this secondary method of return for Thumb instructions.
When these secondary methods of return are used, the exception handler code must test the SPSR T bit in
order to determine which of the two return instructions to use.
A6-3
6.2
15
14
13
12
Shift by immediate
opcode [1]
11
10
Add/subtract register
opc
Add/subtract immediate
opc
Add/subtract/compare/move immediate
opcode
Data-processing register
Branch/exchange
instruction set [3]
Rd
SP-relative offset
Add to SP or PC
SP
Rd
immediate
Miscellaneous:
See Figure 6-2
Load/store multiple
Conditional branch
Undefined instruction
Software interrupt
Unconditional branch
offset
offset
Undefined instruction
BL/BLX prefix
offset
BL suffix
offset
immediate
Rn
Rd
immediate
Rn
Rd
opcode [1]
1
Rm / Rs
Rd / Rn
H1
H2
Rm
Rd / Rn
H2
Rm
SBZ
PC-relative offset
Rm
Rn
Rd
offset
Rn
Rd
offset
Rn
Rd
opcode
Rn
register list
cond [2]
immediate
opcode
Rm
Rd
Rd
Rd / Rn
Rm
offset
immediate
0
x
1.
2.
3.
4.
6.2.1
The opc field is not allowed to be 11 in this line. Other lines deal with the case that the opc field is
11.
The cond field is not allowed to be 1110 or 1111 in this line. Other lines deal with the cases where
the cond field is 1110 or 1111.
The form with L==1 is UNPREDICTABLE prior to ARM architecture version 5.
This is an undefined instruction prior to ARM architecture version 5.
Miscellaneous instructions
Figure 6-2 lists miscellaneous Thumb instructions. An entry in square brackets, for example [1], indicates
a note below the figure.
15
14
13
12
11
10
register list
immediate
opc
immediate
Note
Any instruction with bits[15:12] = 1011, and which is not shown in Figure 6-2, is an undefined instruction.
A6-5
6.3
Branch instructions
Thumb supports six types of branch instruction:
a Branch with Link (subroutine call) is supported with a pair of instructions that allow forward and
backward branches of up to 4MB
a Branch and Exchange instruction branches to an address in a register and optionally switches to
ARM code execution
a Branch with Link and Exchange instruction performs a subroutine call to an address in a register
and optionally switches to ARM code execution
a second form of Branch with Link and Exchange uses a pair of instructions, similar to Branch with
Link, but additionally switches to ARM code execution.
6.3.1
Conditional branch
B<cond>
6.3.2
15
14
13
12
cond
8_bit_signed_offset
<target_address>
<target_address>
<target_address>
15
14
13
12
10
offset_11
A6-6
11
Unconditional branch
B
BL
BLX
6.3.3
<target_address>
<Rm>
<Rm>
15
14
13
12
11
10
H2
Rm
SBZ
6.3.4
Examples
B
label
BCC
label
BEQ
label
BL
func
func
...
...
6.3.5
PC, LR
BX
R12
BL
BX
BLX
Branch with Link and Exchange instruction set. See BL, BLX(1) on page A7-26 and BLX(2)
on page A7-30.
A6-7
6.4
Data-processing instructions
Thumb data-processing instructions are a subset of the ARM data-processing instructions, as shown in
Table 6-2. All Thumb data-processing instructions in this table set the condition codes.
Table 6-2 Thumb data-processing instructions
A6-8
Mnemonic
Operation
Action
ADC Rd, Rm
Rd := Rd + Rm + Carry flag
Add
Rd := Rn + Rm
Add
Rd := Rn + 3-bit immediate
Add
Rd := Rd + 8-bit immediate
AND Rd, Rm
Logical AND
Rd := Rd AND Rm
ASR Rd, Rs
Rd := Rd ASR Rs
BIC Rd, Rm
Bit Clear
Rd := Rd AND NOT Rm
CMN Rn, Rm
Compare Negated
Compare
CMP Rn, Rm
Compare
EOR Rd, Rm
Logical Exclusive OR
Rd := Rd EOR Rm
LSL Rd, Rs
Rd := Rd LSL Rs
LSR Rd, Rs
Rd := Rd LSR Rs
Move
Rd := 8-bit immediate
MOV Rd, Rn
Move
Rd := Rn
MUL Rd, Rm
Multiply
Rd := Rm x Rd
MVN Rd, Rm
Move Not
Rd := NOT Rm
NEG Rd, Rm
Negate
Rd := 0 - Rm
ORR Rd, Rm
Logical (inclusive) OR
Rd := Rd OR Rm
Operation
Action
ROR Rd, Rs
Rotate Right
Rd := Rd ROR Rs
SBC Rd, Rm
Rd := Rd - Rm - NOT(Carry Flag)
Subtract
Rd := Rn - Rm
Subtract
Rd := Rn - 3-bit immediate
Subtract
Rd := Rd - 8-bit immediate
TST Rn, Rm
Test
For example:
ADD
R0, R4, R7
; R0 = R4 + R7
SUB
R6, R1, R2
; R6 = R1 - R2
ADD
R0, #255
; R0 = R0 + 255
ADD
R1, R4, #4
; R1 = R4 + 4
NEG
R3, R1
; R3 = 0 - R1
AND
R2, R5
; R2 = R2 AND R5
EOR
R1, R6
; R1 = R1 EOR R6
CMP
R2, R3
CMP
R7, #100
MOV
R0, #200
; R0 = 200
A6-9
6.4.1
High registers
There are seven types of data-processing instruction which operate on ARM registers 8 to 14 and the PC as
shown in Table 6-3. Apart from CMP, instructions in this table do not change the condition code flags.
Table 6-3 High register data-processing instructions
Mnemonic
Operation
Action
MOV Rd, Rn
Move
Rd := Rn
ADD Rd, Rm
Add
Rd := Rd + Rm
CMP Rn, Rm
Compare
Form PC address
Rd = PC + 4* (8-bit immediate)
For example:
A6-10
MOV
R0, R12
; R0 = R12
ADD
R10, R1, R2
; R6 = R1 - R2
MOV
PC, LR
; PC = R14
CMP
R10, R11
SUB
SP, #12
ADD
SP, #16
ADD
; R2 = SP + 20
ADD
; R0 = PC + 500
6.4.2
Formats
Data-processing instructions use the following eight instruction formats:
Format 1
<opcode1> <Rd>, <Rn>, <Rm>
<opcode1> := ADD | SUB
15
14
13
12
11
10
op_1
Rm
Rn
Rd
Format 2
<opcode2> <Rd>, <Rn>, #<3_bit_immed>
<opcode2> := ADD | SUB
15
14
13
12
11
10
op_2 3_bit_immediate
Rn
Rd
Format 3
<opcode3> <Rd>|<Rn>, #<8_bit_immed>
<opcode3> := ADD | SUB | MOV | CMP
15
14
13
12
11
10
op_3
Rd|Rn
8_bit_immediate
Format 4
<opcode4> <Rd>, <Rm>, #<shift_imm>
<opcode4> := LSL | LSR | ASR
15
14
13
12
11
op_4
10
shift_immediate
Rm
Rd
A6-11
Format 5
<opcode5> <Rd>|<Rn>, <Rm>|<Rs>
<opcode5> := MVN | CMP | CMN | TST | ADC | SBC | NEG | MUL |
LSL | LSR | ASR | ROR | AND | EOR | ORR | BIC
15
14
13
12
11
10
op_5
Rm|Rs
Rd|Rn
Format 6
ADD <Rd>, <reg>, #<8_bit_immed>
<reg> := SP | PC
15
14
13
12
11
reg
10
Rd
8_bit_immediate
Format 7
<opcode6> SP, SP, #<7_bit_immed>
<opcode6> := ADD | SUB
15
14
13
12
11
10
op_6
H1
H2
7_bit_immediate
Format 8
<opcode7> <Rd>|<Rn>, <Rm>
<opcode7> := MOV | ADD | CMP
A6-12
15
14
13
12
11
10
opcode
Rm
Rd|Rn
6.4.3
ADD
ADD
ADD
ADD
ADD
ADD
ADD
AND
ASR
ASR
BIC
CMN
CMP
CMP
CMP
EOR
LSL
LSL
LSR
LSR
MOV
MOV
Move a low register to another low register. See MOV (2) on page A7-67.
MOV
MUL
MVN
NEG
A6-13
A6-14
ORR
ROR
SBC
SUB
SUB
SUB
SUB
TST
6.5
register plus 5-bit immediate (not available for signed halfword and signed byte loads).
If an immediate offset is used, it is scaled by 4 for word access and 2 for halfword accesses.
In addition, three special instructions allow:
6.5.1
words to be loaded using the PC as a base with a 1KB (word-aligned) immediate offset
words to be loaded and stored with the stack pointer (R13) as the base and a 1KB (word-aligned)
immediate offset.
Formats
Load and Store Register instructions have the following formats:
Format 1
<opcode1> <Rd>, [<Rn>, #<5_bit_offset>]
<opcode1> := LDR|LDRH|LDRB|STR|STRH|STRB
15
11
10
opcode1
5_bit_offset
Rn
Rd
Format 2
<opcode2> <Rd>, [<Rn>, <Rm>]
<opcode2> := LDR|LDRH|LDRSH|LDRB|LDRSB|STR|STRH|STRB
15
opcode2
Rm
Rn
Rd
Format 3
LDR
15
14
13
12
11
10
Rd
8_bit_immediate
A6-15
Format 4
<opcode3>
<opcode3>
15
14
13
12
11
10
Rd
8_bit_immediate
For example:
A6-16
LDR
LDR
STR
STRB
STRH
LDRH
LDRB
LDR
LDR
; Load R5 from SP + 64
STR
6.5.2
LDR
LDR
LDR
LDRB
Load Unsigned Byte (immediate offset). See LDRB (1) on page A7-50.
LDRB
Load Unsigned Byte (register offset). See LDRB (2) on page A7-51.
LDRH
Load Unsigned Halfword (immediate offset). See LDRH (1) on page A7-52.
LDRH
Load Unsigned Halfword (register offset). See LDRH (2) on page A7-54.
LDRSB
LDRSH
STR
STR
STR
STRB
STRB
STRH
STRH
A6-17
6.6
Two instructions, LDMIA and STMIA, are designed to support block copy. They have a fixed
Increment After addressing mode from a base register.
The other two instructions, PUSH and POP, also have a fixed addressing mode. They implement a
full descending stack and the stack pointer (R13) is used as the base register.
All four instructions update the base register after transfer and all can transfer any or all of the lower 8
registers. PUSH can also stack the return address, and POP can load the PC.
6.6.1
Formats
Load and Store Multiple instructions have the following formats:
Format 1
<opcode1>
<opcode1>
<Rn>!, <registers>
:= LDMIA | STMIA
15
14
13
12
11
10
Rn
register_list
Format 2
PUSH
POP
6.6.2
{<registers>}
{<registers>}
15
14
13
12
11
10
register_list
Examples
LDMIA
STMIA
function
PUSH
{R0-R7, LR}
{R0-R7, PC}
...
...
POP
A6-18
6.6.3
POP
PUSH
STMIA
A6-19
6.7
Exception-generating instructions
The Thumb instruction set provides two types of instruction whose main purpose is to cause a processor
exception to occur:
The Software Interrupt (SWI) instruction is used to cause a SWI exception to occur (see Software
Interrupt exception on page A2-16). This is the main mechanism in the Thumb instruction set by
which User mode code can make calls to privileged Operating System code.
The Breakpoint (BKPT) instruction is used for software breakpoints in T variants of ARM
architecture versions 5 and above. Its default behavior is to cause a Prefetch Abort exception to occur
(see Prefetch Abort (instruction fetch memory abort) on page A2-16). A debug monitor program that
has previously been installed on the Prefetch Abort vector can handle this exception.
If debug hardware is present in the system, it is allowed to override this default behavior. Details of
whether and how this happens are IMPLEMENTATION DEFINED.
6.7.1
Instruction encodings
SWI
<immed_8>
15
14
13
12
11
10
BKPT
immed_8
<immed_8>
15
14
13
12
11
10
immed_8
In both SWI and BKPT, the immed_8 field of the instruction is ignored by the ARM processor. The SWI or
Prefetch Abort handler can optionally be written to load the instruction that caused the exception and extract
these fields. This allows them to be used to communicate extra information about the Operating System call
or breakpoint to the handler.
6.7.2
A6-20
SWI
6.8
14
13
12
11
10
In general, these instructions can be used to extend the Thumb instruction set in the future. However, it is
intended that the following group of instructions will not be used in this manner:
15
14
13
12
11
10
Use one of these instructions if you want to use an undefined instruction for software purposes, with
minimal risk that future hardware will treat it as a defined instruction.
A6-21
A6-22
Chapter A7
Thumb Instructions
This chapter describes the syntax and usage of every Thumb instruction, in the section:
A7-1
Thumb Instructions
7.1
7.1.1
General notes
These notes explain the types of information and abbreviations used on the instruction pages.
Syntax abbreviations
The following abbreviations are used in the instruction pages:
immed_<n> This is an <n>-bit immediate value. For example, an 8-bit immediate value is represented
by:
immed_8
signed_immed_<n>
This is a signed immediate. For example, an 8-bit signed immediate is represented by:
signed_immed_8
Architecture version
For the convenience of the reader, this section describes the version of the ARM instruction set that the
instruction is associated with, not the version of the Thumb instruction set. There have been two versions
of the Thumb instruction set architecture to date:
THUMBv1
THUMBv2
This is used in T variants of version 5 and above of the ARM instruction set architecture.
Instructions which are described as being in all T variants are therefore present in both THUMBv1 and
THUMBv2, while those that are described as being in T variants of version 5 and above are in THUMBv2
only.
A7-2
Thumb Instructions
Information on usage
Usage information is only given for Thumb instructions where it differs significantly from ARM instruction
usage. If no Usage section appears for a Thumb instruction, see the equivalent ARM instruction page in
Chapter A4 ARM Instructions for usage information.
A7-3
Thumb Instructions
7.1.2
ADC
15
14
13
12
11
10
Rm
Rd
The ADC (Add with Carry) instruction can be used to synthesize multi-word addition. The condition code
flags are updated, based on the result.
Syntax
ADC
<Rd>, <Rm>
where:
<Rd>
Holds the first value for the addition, and is the destination register for the operation.
<Rm>
Specifies the register that contains the second operand for the addition.
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd + Rm + C Flag
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = CarryFrom(Rd + Rm + C Flag)
V Flag = OverflowFrom(Rd + Rm + C Flag)
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 0 1 0 1 1
A7-4
16 15
Rd
12 11 10 9 8
Rd
4 3
0 0 0 0 0 0 0 0
Rm
Thumb Instructions
7.1.3
ADD (1)
15
14
13
12
11
10
immed_3
Rn
Rd
This form of ADD adds a small constant value to the value of a register and stores the result in a second
register. The condition code flags are updated, based on the result.
Syntax
ADD
where:
<Rd>
<Rn>
Specifies the register that contains the operand for the addition.
<immed_3>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rn + immed_3
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = CarryFrom(Rn + immed_3)
V Flag = OverflowFrom(Rn + immed_3)
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 0 1 0 0 1
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0 0 immed_3
A7-5
Thumb Instructions
7.1.4
ADD (2)
15
14
13
12
11
10
Rd
immed_8
This form of ADD adds a large immediate value to the value of a register and stores the result back in the
same register. The condition code flags are updated, based on the result.
Syntax
ADD
<Rd>, #<immed_8>
where:
<Rd>
Holds the first operand for the addition, and is the destination register for the
completed operation.
<immed_8>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd + immed_8
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = CarryFrom(Rd + immed_8)
V Flag = OverflowFrom(Rd + immed_8)
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 0 1 0 0 1
A7-6
16 15
Rd
12 11 10 9 8
Rd
0 0 0 0
immed_8
Thumb Instructions
7.1.5
ADD (3)
15
14
13
12
11
10
Rm
Rn
Rd
This form of ADD adds the value of one register to the value of a second register, and stores the result in a
third register. The condition code flags are updated, based on the result.
Syntax
ADD
where:
<Rd>
<Rn>
Specifies the register containing the first value for the addition.
<Rm>
Specifies the register containing the second value for the addition.
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rn + Rm
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = CarryFrom(Rn + Rm)
V Flag = OverflowFrom(Rn + Rm)
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 0 1 0 0 1
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-7
Thumb Instructions
7.1.6
ADD (4)
15
14
13
12
11
10
H1
H2
Rm
Rd
This form of ADD adds the values of two registers, one or both of which are high registers. Unlike the
low-register ADD instruction (ADD (3) on page A7-7), this instruction does not change the flags.
Syntax
ADD
<Rd>, <Rm>
where:
<Rd>
Specifies the register containing the first value, and is also the destination register. It can be
any of R0 to R15. The register number is encoded in the instruction in H1 (most significant
bit) and Rd (remaining three bits).
<Rm>
Specifies the register containing the second value. It can be any of R0 to R15. Its number is
encoded in the instruction in H2 (most significant bit) and Rm (remaining three bits).
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd + Rm
Notes
Operand restriction If a low register is specified for <Rd> and Rm (H1==0 and H2==0), the result is
UNPREDICTABLE.
A7-8
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19 18
1 1 1 0 0 0 0 0 1 0 0 0 H1
16 15 14
Rd
H1
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0 H2
Rm
There are slight differences when the instruction accesses the PC, because of the different definitions of the
PC when executing ARM and Thumb code.
A7-9
Thumb Instructions
7.1.7
ADD (5)
15
14
13
12
11
10
Rd
immed_8
This form of ADD adds an immediate value to the PC and writes the resulting PC-relative address to a
destination register. The immediate can be any multiple of 4 in the range 0 to 1020. The condition codes are
not affected.
Syntax
ADD
where:
<Rd>
PC
<immed_8> Specifies an 8-bit immediate value that is quadrupled and added to the value of the PC.
Architecture version
All T variants
Exceptions
None
Operation
Rd = (PC AND 0xFFFFFFFC) + (immed_8 << 2)
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15
1 1 1 0 0 0 1 0 1 0 0 0 1 1 1 1
12 11 10 9 8
Rd
1 1 1 1
immed_8
The definitions of the PC differ between ARM and Thumb code. This makes a difference between the
precise results of the instructions.
A7-10
Thumb Instructions
7.1.8
ADD (6)
15
14
13
12
11
10
Rd
immed_8
This form of ADD adds an immediate value to the SP and writes the resulting SP-relative address to a
destination register. The immediate can be any multiple of 4 in the range 0 to 1020. The condition codes are
not affected.
Syntax
ADD
where:
<Rd>
SP
<immed_8> Specifies an 8-bit immediate value that is quadrupled and added to the value of the SP.
Architecture version
All T variants
Exceptions
None
Operation
Rd = SP + (immed_8 << 2)
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15
1 1 1 0 0 0 1 0 1 0 0 0 1 1 0 1
12 11 10 9
Rd
1 1 1 1
immed_8
A7-11
Thumb Instructions
7.1.9
ADD (7)
15
14
13
12
11
10
immed_7
This form of ADD increments the SP by four times a 7-bit immediate (that is, by a multiple of 4 in the range
0 to 508). The condition codes are not affected.
Syntax
ADD
SP, #<immed_7> * 4
where:
Contains the first operand for the addition. SP is also the destination register for the
operation.
SP
<immed_7> Specifies the immediate value that is quadrupled and added to the value of the SP.
Architecture version
All T variants
Exceptions
None
Operation
SP = SP + (immed_7 << 2)
Usage
For the Full Descending stack which the Thumb instruction set is designed to use, incrementing the SP is
used to discard data on the top of the stack.
Notes
Alternative syntax
This instruction can also be written as ADD SP, SP, #(<immed_7> * 4).
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8
1 1 1 0 0 0 1 0 1 0 0 0 1 1 0 1 1 1 0 1 1 1 1 1 0
A7-12
immed_7
Thumb Instructions
7.1.10
AND
15
14
13
12
11
10
Rm
Rd
The AND (Logical AND) instruction performs a bitwise AND of the values in two registers. The condition
code flags are updated, based on the result.
Syntax
AND
<Rd>, <Rm>
where:
<Rd>
Specifies the register containing the first operand, and is also the destination register.
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd AND Rm
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = unaffected
V Flag = unaffected
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 0 0 0 0 1
16 15
Rd
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-13
Thumb Instructions
7.1.11
ASR (1)
15
14
13
12
11
10
immed_5
Rm
Rd
This form of the ASR (Arithmetic Shift Right) instruction is used to provide the signed value of a register
divided by a constant power of 2. The condition code flags are updated, based on the result.
Syntax
ASR
where:
<Rd>
<Rm>
<immed_5>
Specifies the shift amount, in the range 1 to 32. Shifts by 1 to 31 are encoded directly
in immed_5. A shift by 32 is encoded as immed_5 == 0.
Architecture version
All T variants
Exceptions
None
Operation
if immed_5 == 0
C Flag = Rm[31]
if Rm[31] == 0 then
Rd = 0
else /* Rm[31] == 1 */]
Rd = 0xFFFFFFFF
else /* immed_5 > 0 */
C Flag = Rm[immed_5 - 1]
Rd = Rm Arithmetic_Shift_Right immed_5
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
V Flag = unaffected
A7-14
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 1
16 15
SBZ
12 11
Rd
immed_5
6 5
1 0 0
Rm
A7-15
Thumb Instructions
7.1.12
ASR (2)
15
14
13
12
11
10
Rs
Rd
This form of ASR is used to provide the signed value of a register divided by a variable power of 2. The
condition code flags are updated, based on the result.
Syntax
ASR
<Rd>, <Rs>
where:
<Rd>
Contains the value to be shifted, and is also the destination register for the completed
operation.
<Rs>
Architecture version
All T variants
Exceptions
None
Operation
if Rs[7:0] == 0 then
C Flag = unaffected
Rd = unaffected
else if Rs[7:0] < 32 then
C Flag = Rd[Rs[7:0] - 1]
Rd = Rd Arithmetic_Shift_Right Rs[7:0]
else /* Rs[7:0] >= 32 */
C Flag = Rd[31]
if Rd[31] == 0 then
Rd = 0
else /* Rd[31] == 1 */
Rd = 0xFFFFFFFF
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
V Flag = unaffected
A7-16
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 1
16 15
SBZ
12 11
Rd
Rs
6 5
0 1 0 1
Rd
A7-17
Thumb Instructions
7.1.13
B (1)
15
14
13
12
11
cond
signed_immed_8
This form of the B (Branch) instruction provides a conditional branch to a target address.
Syntax
B<cond>
<target_address>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5.
<target_address>
Specifies the address to branch to. The branch target address is calculated by:
1.
2.
3.
Shifting the 8-bit signed offset field of the instruction left by one bit.
Sign-extending the result to 32 bits.
Adding this to the contents of the PC (which contains the address of the branch
instruction plus 4).
Architecture version
All T variants
Exceptions
None
Operation
if ConditionPassed(cond) then
PC = PC + (SignExtend(signed_immed_8) << 1)
A7-18
Thumb Instructions
Usage
To calculate the correct value of signed_immed_8, the assembler (or other toolkit component) needs to:
1.
Form the base address for the branch. This is the address of the branch instruction, plus 4. In other
words, the base address is equal to the PC value read by that instruction.
Subtract the base address from the target address to form a byte offset. This offset is always even,
because all Thumb instructions are halfword-aligned.
If the byte offset is outside the range -256 to +254, use an alternative code-generation strategy or
produce an error as appropriate.
Otherwise, set the signed_immed_8 field of the instruction to the byte offset divided by 2.
2.
3.
4.
Notes
Memory bounds
Branching backwards past location zero and forwards over the end of the 32-bit
address space is UNPREDICTABLE.
AL condition
NV condition
If the condition field indicates NV (0b1111), the instruction is a SWI instead (see
SWI on page A7-102).
<target_address>
28 27 26 25 24 23
cond
1 0 1 0
signed_immed_8
This differs from the Thumb instruction, because the offset in the ARM instruction is shifted left by 2 before
being added to the PC, whereas the offset in the Thumb instruction is shifted left by 1. Also, the PC values
read by the ARM and Thumb instructions are different.
A7-19
Thumb Instructions
7.1.14
B (2)
15
14
13
12
11
10
signed_immed_11
Syntax
B
<target_address>
where:
<target_address>
Specifies the address to branch to. The branch target address is calculated by:
1.
2.
3.
Shifting the 11-bit signed offset of the instruction left one bit.
Sign-extending the result to 32 bits.
Adding this to the contents of the PC (which contains the address of the branch
instruction plus 4).
Architecture version
All T variants
Exceptions
None
Operation
PC = PC + (SignExtend(signed_immed_11) << 1)
Usage
To calculate the correct value of signed_immed_11, the assembler (or other toolkit component) needs to:
1.
2.
3.
4.
A7-20
Form the base address for the branch. This is the address of the branch instruction, plus 4. In other
words, the base address is equal to the PC value read by that instruction.
Subtract the base address from the target address to form a byte offset. This offset is always even,
because all Thumb instructions are halfword-aligned.
If the byte offset is outside the range -2048 to +2046, use an alternative code-generation strategy or
produce an error as appropriate.
Otherwise, set the signed_immed_11 field of the instruction to the byte offset divided by 2.
Thumb Instructions
Notes
Memory bounds
Branching backwards past location zero and forwards over the end of the 32-bit
address space is UNPREDICTABLE.
<target_address>
31
28 27 26 25 24 23
1 1 1 0 1 0 1 0
11 10
signed_immed_11
This differs from the Thumb instruction, because the offset in the ARM instruction is shifted left by 2 before
being added to the PC, whereas the offset in the Thumb instruction is shifted left by 1. Also, the PC values
read by the ARM and Thumb instructions are different.
A7-21
Thumb Instructions
7.1.15
BIC
15
14
13
12
11
10
Rm
Rd
The BIC (Bit Clear) instruction performs a bitwise AND of the value of one register and the bitwise inverse
of the value of another register. The condition code flags are updated, based on the result.
Syntax
BIC
<Rd>, <Rm>
where:
<Rd>
Is the register containing the value to be ANDed, and is also the destination register for the
completed operation.
<Rm>
Specifies the register that contains the value whose complement is ANDed with the value
in <Rd>.
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd AND NOT Rm
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = unaffected
V Flag = unaffected
A7-22
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 1 0 1
16 15
Rd
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-23
Thumb Instructions
7.1.16
BKPT
15
14
13
12
11
10
immed_8
The BKPT (Breakpoint) instruction causes a software breakpoint to occur. This breakpoint can be handled
by an exception handler installed on the prefetch abort vector. In implementations which also include debug
hardware, the hardware can optionally override this behavior and handle the breakpoint itself. When this
occurs, the prefetch abort vector is not entered.
Syntax
BKPT
<immed_8>
where:
<immed_8> Is an 8-bit immediate value, which is placed in bits[7:0] of the instruction. This value is
ignored by the ARM hardware, but can be used by a debugger to store additional
information about the breakpoint.
Architecture version
T variants of version 5 and above
Exceptions
Prefetch Abort
Operation
if (not overridden by debug hardware)
R14_abt
= address of BKPT instruction + 4
SPSR_abt = CPSR
CPSR[4:0] = 0b10111
/* Enter Abort mode */
CPSR[5]
= 0
/* Execute in ARM state */
/* CPSR[6] is unchanged */
CPSR[7]
= 1
/* Disable normal interrupts */
if high vectors configured then
PC
= 0xFFFF000C
else
PC
= 0x0000000C
A7-24
Thumb Instructions
Usage
The exact usage of the BKPT instruction depends on the debug system being used. A debug system can use
the BKPT instruction in two ways:
Debug hardware (if present) does not override the normal behavior of the BKPT instruction, and so
the prefetch abort vector is entered. If the system also allows real prefetch aborts to occur, the
prefetch abort handler determines (in a system-dependent manner) whether the vector entry occurred
as a result of a BKPT instruction or as a result of a real prefetch abort, and branches to debug code or
prefetch abort code accordingly. Otherwise, the prefetch abort handler just branches straight to debug
code.
When used in this manner, the BKPT instruction must be avoided within abort handlers, as it corrupts
R14_abt and SPSR_abt. For the same reason, it must also be avoided within FIQ handlers, as an FIQ
interrupt can occur within an abort handler.
Debug hardware overrides the normal behavior of the BKPT instruction and handles the software
breakpoint itself. When finished, it typically either resumes execution at the instruction following the
BKPT, or replaces the BKPT in memory with another instruction and resumes execution at that
instruction.
When BKPT is used in this manner, R14_abt and SPSR_abt are not corrupted, and so the above
restrictions about its use in abort and FIQ handlers do not apply.
Notes
Hardware override
<immed_8>
31 30 29 28 27 26 25 24 23 22 21 10 19 18 17 6 15 14 13 12 11
1 1 1 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0
immed_8
[7:4]
0 1 1 1
immed_8
[3:0]
A7-25
Thumb Instructions
7.1.17
BL, BLX(1)
15
14
13
12
11
10
offset_11
This form of the BL (Branch with Link) instruction provides an unconditional subroutine call to another
Thumb routine. The return from subroutine is typically performed by one of the following:
MOV PC,LR
BX LR
The first Thumb instruction has H == 10 and supplies the high part of the branch offset. This
instruction sets up for the subroutine call and is shared between the BL and BLX forms.
The second Thumb instruction has H == 11 (for BL) or H == 01 (for BLX). It supplies the low part
of the branch offset and causes the subroutine call to take place.
Syntax
BL
BLX
<target_addr>
<target_addr>
where:
<target_addr>
Specifies the address to branch to. The branch target address is calculated by:
1.
2.
3.
4.
Shifting the offset_11 field of the first instruction left twelve bits.
Sign-extending the result to 32 bits.
Adding this to the contents of the PC (which contains the address of the first
instruction plus 4).
Adding twice the offset_11 field of the second instruction. For BLX, the
resulting address is forced to be word-aligned by clearing bit[1].
Architecture version
BL (H == 10 and H == 11 forms) is in all T variants.
BLX (H == 01 form) is in T variants of version 5 and above.
A7-26
Thumb Instructions
Exceptions
None
Operation
if H == 10 then
LR = PC + (SignExtend(offset_11) << 12)
else if H == 11 then
PC = LR + (offset_11 << 1)
LR = (address of next instruction) | 1
else if H == 01 then
PC = (LR + (offset_11 << 1)) AND 0xFFFFFFFC
LR = (address of next instruction) | 1
T Flag = 0
Usage
To generate the correct pair of instructions, the assembler (or other toolkit component) must first generate
the branch offset, as follows:
1.
2.
3.
Form the base address for the branch. This is the address of the first of the two Thumb instructions
(the one with H == 10), plus 4. In other words, the base address is equal to the PC value read by that
instruction.
If the instruction is BLX, set bit[1] of the target address to be equal to bit[1] of the base address. This
is an exception to the normal rule that bits[1:0] of the address of an ARM instruction are 0b00. This
adjustment is required to ensure that the restrictions associated with the H == 01 form of the
instruction are obeyed.
Subtract the base address from the target address to form the offset.
The resulting offset is always even. If the offset lies outside the range:
-222 <= offset <= +222 - 2
the target address lies outside the addressing range of these instructions. This results in alternative code or
an error, as appropriate.
If the offset is in range, a sequence of two Thumb instructions must be generated, both using the above form:
The second with H == 11 (for BL) or H== 01 (for BLX) and offset_11 = offset[11:1].
A7-27
Thumb Instructions
Notes
Encoding
Memory bounds
Branching backwards past location zero and forwards over the end of the 32-bit
address space is UNPREDICTABLE.
Instruction pairs
These Thumb instructions must always occur in the pairs described above.
Specifically:
Also, except as noted below under Exceptions, the second instruction of the pair
must not be the target of any branch, whether as the result of a branch instruction or
of some other instruction that changes the PC.
Failure to adhere to any of these restrictions can result in UNPREDICTABLE behavior.
Exceptions
A7-28
Thumb Instructions
<target_addr>
31 30 29 28 27 26 25 24 23 22 21 20
1 1 1 1 1 0 1 L offset sign
offset[22:2]
where L == offset[1].
To call an ARM routine:
BL
<target_addr>
31 30 29 28 27 26 25 24 23 22 21 20
1 1 1 0 1 0 1 1 offset sign
offset[22:2]
These differ slightly from the Thumb instruction pairs because of the different values of the PC in ARM and
Thumb code. This can be compensated for by adjusting the offset by 4.
A7-29
Thumb Instructions
7.1.18
BLX(2)
15
14
13
12
11
10
H2
Rm
SBZ
This form of BLX is used to call an ARM or Thumb subroutine from the Thumb instruction set, at an address
specified in a register. This instruction branches and selects the instruction decoder to use to decode the
instructions at the branch destination.
The T flag is updated with bit[0] of the value of register Rm. To return from the subroutine to the caller, use
BX R14.
Syntax
BLX
<Rm>
where:
<Rm>
Is the register that contains the branch target address. It can be any of R0 to R14. The register
number is encoded in the instruction in H2 (most significant bit) and Rm (remaining three
bits). If R15 is specified for <Rm>, the results are UNPREDICTABLE.
Architecture version
T variants of version 5 and above
Exceptions
None
Operation
LR = (address of the instruction after this BLX) | 1
T Flag = Rm[0]
PC = Rm[31:1] << 1
Notes
Encoding
Bit 7 is the H1 bit for some of the other instructions that access the high registers. If it is 0
for this instruction, rather than 1 as shown, the instruction is a BX instruction instead (see
BX on page A7-32).
A7-30
Thumb Instructions
<Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 0 0 1 0
16 15
SBO
12 11
SBO
SBO
6 5
0 0 1 1 H2
Rm
A7-31
Thumb Instructions
7.1.19
BX
15
14
13
12
11
10
H2
Rm
SBZ
The BX (Branch and Exchange) instruction is used to branch between ARM code and Thumb code.
Syntax
BX
<Rm>
where:
Is the register that contains the branch target address. It can be any of R0 to R15. The register
number is encoded in the instruction in H2 (most significant bit) and Rm (remaining three
bits).
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
T Flag = Rm[0]
PC = Rm[31:1] << 1
Usage
The normal subroutine return instruction in Thumb code is BX R14. The following subroutine call
instructions leave a suitable return value in R14:
ARM BLX instructions (See BLX (1) on page A4-16 and BLX (2) on page A4-18)
Thumb BL and BLX instructions (see BL, BLX(1) on page A7-26 and BLX(2) on page A7-30).
In T variants of ARM architecture version 4, a subroutine call to an ARM routine can be performed by a
code sequence of the form:
<Put address of routine to call in Ra>
MOV
LR,PC
; Return to second following instruction
BX
Ra
In T variants of ARM architecture 5 and above, a subroutine call to an ARM routine can be performed more
efficiently with a BLX instruction (see BL, BLX(1) on page A7-26 and BLX(2) on page A7-30).
A7-32
Thumb Instructions
Notes
Encoding
Bit 7 is the H1 bit for some of the other instructions that access the high registers. If it is 1
for this instruction, rather than 0 as shown, the instruction is:
a BLX instruction instead in ARM architecture version 5 and above (see BLX(2) on
page A7-30)
UNPREDICTABLE
Register 15 can be specified for <Rm>. If this is done, R15 is read as normal for Thumb
code, that is, it is the address of the BX instruction itself plus 4. If the BX instruction is at a
word-aligned address, this results in a branch to the next word, executing in ARM state.
However, if the BX instruction is not at a word-aligned address, this means that the results
of the instruction are UNPREDICTABLE (because the value read for R15 has bits[1:0]==0b10).
<Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 0 0 1 0
16 15
SBO
12 11
SBO
SBO
6 5
0 0 0 1 H2
Rm
This ARM instruction is not quite equivalent to the Thumb instruction, because their specified behavior
differs when <Rm> is R15.
A7-33
Thumb Instructions
7.1.20
CMN
15
14
13
12
11
10
Rm
Rn
The CMN (Compare Negative) instruction compares a register value with the negation of another register
value. The condition flags are updated, based on the result of adding the two register values, so that
subsequent instructions can be conditionally executed (using a conditional branch).
Syntax
CMN
<Rn>, <Rm>
where:
<Rn>
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
alu_out = Rn + Rm
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn + Rm)
V Flag = OverflowFrom(Rn + Rm)
<Rn>, <Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 0 1 1 1
A7-34
16 15
Rn
12 11 10 9 8
SBZ
4 3
0 0 0 0 0 0 0 0
Rm
Thumb Instructions
7.1.21
CMP (1)
15
14
13
12
11
10
Rn
immed_8
This form of the CMP (Compare) instruction compares a register value with a large immediate value. The
condition flags are updated, based on the result of subtracting the constant from the register value, so that
subsequent instructions can be conditionally executed (using a conditional branch).
Syntax
CMP
<Rn>, #<immed_8>
where:
<Rn>
<immed_8>
Architecture version
All T variants
Exceptions
None
Operation
alu_out = Rn - immed_8
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - immed_8)
V Flag = OverflowFrom(Rn - immed_8)
<Rn>, #<immed_8>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 1 0 1 0 1
16 15
Rn
12 11 10 9
SBZ
0 0 0 0
immed_8
A7-35
Thumb Instructions
7.1.22
CMP (2)
15
14
13
12
11
10
Rm
Rn
This form of CMP compares two register values. The condition code flags are updated, based on the result
of subtracting the second register value from the first, so that subsequent instructions can be conditionally
executed (using a conditional branch).
Syntax
CMP
<Rn>, <Rm>
where:
<Rn>
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
alu_out = Rn - Rm
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - Rm)
V Flag = OverflowFrom(Rn - Rm)
<Rn>, <Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 0 1 0 1
A7-36
16 15
Rn
12 11 10 9 8
SBZ
4 3
0 0 0 0 0 0 0 0
Rm
Thumb Instructions
7.1.23
CMP (3)
15
14
13
12
11
10
H1
H2
Rm
Rn
This form of CMP compares the values of two registers, one or both of which are high registers. The
condition flags are updated, based on the result of subtracting the second register value from the first, so that
subsequent instructions can be conditionally executed (using a conditional branch).
Syntax
CMP
<Rn>, <Rm>
where:
<Rn>
Is the register containing the first value. It can be any of R0 to R15. Its number is encoded
in the instruction in H1 (most significant bit) and Rn (remaining three bits).
<Rm>
Is the register containing the second value. It can be any of R0 to R15. Its number is encoded
in the instruction in H2 (most significant bit) and Rm (remaining three bits).
Architecture version
All T variants
Exceptions
None
Operation
alu_out = Rn - Rm
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - Rm)
V Flag = OverflowFrom(Rn - Rm)
Notes
Operand restriction If a low register is specified for both <Rn> and <Rm> (H1==0 and H2==0), the
result is UNPREDICTABLE.
A7-37
Thumb Instructions
<Rn>, <Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19 18
1 1 1 0 0 0 0 1 0 1 0 1 H1
16 15
Rn
12 11 10 9 8
SBZ
4 3
0 0 0 0 0 0 0 0 H2
Rm
There are slight differences when the instruction accesses the PC, because of the different definitions of the
PC when executing ARM and Thumb code.
A7-38
Thumb Instructions
7.1.24
EOR
15
14
13
12
11
10
Rm
Rd
The EOR (Exclusive OR) instruction performs a bitwise EOR of the values in two registers. The condition
code flags are updated, based on the result.
Syntax
EOR
<Rd>, <Rm>
where:
<Rd>
Specifies the register containing the first operand, and is also the destination register.
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd EOR Rm
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = unaffected
V Flag = unaffected
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 0 0 0 1 1
16 15
Rd
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-39
Thumb Instructions
7.1.25
LDMIA
15
14
13
12
11
10
Rn
register_list
The LDMIA (Load Multiple Increment After) instruction loads a non-empty subset, or possibly all, of the
general-purpose registers from sequential memory locations.
Syntax
LDMIA
<Rn>!, <registers>
where:
<Rn>
<registers>
The registers are loaded in sequence, the lowest-numbered register from the lowest
memory address (start_address), through to the highest-numbered register
from the highest memory address (end_address).
The start_address is the value of the base register <Rn>. Subsequent
addresses are formed by incrementing the previous address by four. One address is
produced for each register that is specified in <registers>.
The end_address value is four less than the sum of the value of the base register
and four times the number of registers specified in <registers>.
Finally, the base register <Rn> is incremented by four times the numbers of
registers in <registers>.
Architecture version
All T variants
Exceptions
Data Abort
A7-40
Thumb Instructions
Operation
start_address = Rn
end_address = Rn + (Number_Of_Set_Bits_In(register_list) * 4) - 4
address = start_address
for i = 0 to 7
if register_list[i] == 1
Ri = Memory[address,4]
address = address + 4
assert end_address == address - 4
Rn = Rn + (Number_Of_Set_Bits_In(register_list) * 4)
Usage
The LDMIA instruction is useful as a block load instruction. Combined with STMIA (Store Multiple), it
allows efficient block copy.
Notes
Operand restrictions
If the base register <Rn> is specified in <registers>, the final value of <Rn> is the
loaded value (not the written-back value).
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
Load Multiple instructions ignore the least significant two bits of address.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception.
Time order
The time order of the accesses to individual words of memory generated by this instruction
is only defined in some circumstances. See Data accesses to memory-mapped I/O on
page A2-32 for details.
<Rn>!, <registers>
<Rn>, <registers>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 1 0 0 0 1 0 W 1
16 15 14 13 12 11 10 9
Rn
0 0 0 0 0 0 0 0
register_list
A7-41
Thumb Instructions
7.1.26
LDR (1)
15
14
13
12
11
10
immed_5
Rn
Rd
This form of the LDR (Load Register) instruction allows 32-bit memory data to be loaded into a
general-purpose register. The addressing mode is useful for accessing structure (record) fields.
With an offset of zero, the address produced is the unaltered value of the base register <Rn>.
Syntax
LDR
where:
<Rd>
<Rn>
<immed_5> Is a 5-bit value that is multiplied by 4 and added to the value of <Rn> to form the memory
address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + (immed_5 * 4)
if address[1:0] == 0b00
data = Memory[address,4]
else
data = UNPREDICTABLE
Rd = data
A7-42
Thumb Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not word-aligned and no data abort occurs, the value written to the
destination register is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception (a type of data abort).
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 0 1 1 0 0 1
16 15
Rn
12 11 10 9
Rd
0 0 0 0 0
immed_5
1 0
0 0
A7-43
Thumb Instructions
7.1.27
LDR (2)
15
14
13
12
11
10
Rm
Rn
Rd
This form of LDR allows 32-bit memory data to be loaded into a general-purpose register. The addressing
mode is useful for pointer+large offset arithmetic and for accessing a single element of an array.
Syntax
LDR
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register containing the second value used in forming the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
if address[1:0] == 0b00
data = Memory[address,4]
else
data = UNPREDICTABLE
Rd = data
A7-44
Thumb Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not word-aligned and no data abort occurs, the value written to the
destination register is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception (a type of data abort).
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 1 1 1 0 0 1
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-45
Thumb Instructions
7.1.28
LDR (3)
15
14
13
12
11
10
Rd
immed_8
This form of LDR allows 32-bit memory data to be loaded into a general-purpose register. The addressing
mode is useful for accessing PC-relative data.
Syntax
LDR
where:
<Rd>
PC
Is the program counter. Its value is used to calculate the memory address. Bit 1 of the PC
value is forced to zero for the purpose of this calculation, so the address is always
word-aligned.
<immed_8> Is an 8-bit value that is multiplied by 4 and added to the value of the PC to form the memory
address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = (PC[31:2] << 2) + (immed_8 * 4)
Rd = Memory[address, 4]
Notes
Data abort
A7-46
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15
1 1 1 0 0 1 0 1 1 0 0 1 1 1 1 1
12 11 10 9
Rd
0 0
immed_8
1 0
0 0
There are slight differences caused by the different definitions of the PC and the fact that the Thumb
instruction ignores bit[1] of the PC.
A7-47
Thumb Instructions
7.1.29
LDR (4)
15
14
13
12
11
10
Rd
immed_8
This form of LDR allows 32-bit memory data to be loaded into a general-purpose register. The addressing
mode is useful for accessing stack data.
Syntax
LDR
where:
<Rd>
SP
Is the stack pointer. Its value is used to calculate the memory address.
<immed_8> Is an 8-bit value that is multiplied by 4 and added to the value of the SP to form the memory
address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = SP + (immed_8 * 4)
if address[1:0] == 0b00
data = Memory[address,4]
else
data = UNPREDICTABLE
Rd = data
A7-48
Thumb Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not word-aligned and no data abort occurs, the value written to the
destination register is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception (a type of data abort).
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15
1 1 1 0 0 1 0 1 1 0 0 1 1 1 0 1
12 11 10 9
Rd
0 0
immed_8
1 0
0 0
A7-49
Thumb Instructions
7.1.30
LDRB (1)
15
14
13
12
11
10
immed_5
Rn
Rd
This form of the LDRB (Load Register Byte) instruction loads a byte from memory and zero-extends it to
form a 32-bit word which is written to a general-purpose register. The addressing mode is useful for
accessing structure (record) fields. With an offset of zero, the address produced is the unaltered value of the
base register <Rn>.
Syntax
LDRB
where:
<Rd>
<Rn>
<immed_5> Is a 5-bit value that is added to the value of <Rn> to form the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + immed_5
Rd = Memory[address,1]
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 0 1 1 1 0 1
A7-50
16 15
Rn
12 11 10 9 8
Rd
0 0 0 0 0 0 0
immed_5
Thumb Instructions
7.1.31
LDRB (2)
15
14
13
12
11
10
Rm
Rn
Rd
This form of LDRB loads a byte from memory and zero-extends it to form a 32-bit word, which is written
to a general-purpose register. The addressing mode is useful for pointer+large offset arithmetic and for
accessing a single element of an array.
Syntax
LDRB
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register containing the second value used in forming the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
Rd = Memory[address,1]
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 1 1 1 1 0 1
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-51
Thumb Instructions
7.1.32
LDRH (1)
15
14
13
12
11
10
immed_5
Rn
Rd
This form of the LDRH (Load Register Halfword) instruction loads a halfword (16 bits) from memory and
zero-extends it to form a 32-bit word, which is written to a general-purpose register. The addressing mode
is useful for accessing structure (record) fields. With an offset of zero, the address produced is the unaltered
value of the base register <Rn>.
Syntax
LDRH
where:
<Rd>
<Rn>
<immed_5> Is a 5-bit value that is multiplied by 2, then added to the value of <Rn> to form the memory
address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + (immed_5 * 2)
if address[0] == 0
data = Memory[address,2]
else
data = UNPREDICTABLE
Rd = data
A7-52
Thumb Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not halfword-aligned and no data abort occurs, the value written
to the destination register is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bit[0] != 0 causes
an alignment exception (a type of data abort).
31 30 29 28 27 26 25 24 23 22 21 10 19
1 1 1 0 0 0 0 1 1 1 0 1
16 15
Rn
12 11 10 9
Rd
7 6 5 4 3
immed
1 0 1 1
0 0
[4:3]
1 0
immed
[2:0]
A7-53
Thumb Instructions
7.1.33
LDRH (2)
15
14
13
12
11
10
Rm
Rn
Rd
This form of LDRH loads a halfword (16 bits) from memory and zero-extends it to form a 32-bit word, which
is written to a general-purpose register. The addressing mode is useful for pointer + large offset arithmetic
and for accessing a single element of an array.
Syntax
LDRH
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register containing the second value used in forming the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
if address[0] == 0
data = Memory[address,2]
else
data = UNPREDICTABLE
Rd = data
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not halfword-aligned and no data abort occurs, the value written
to the destination register is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bit[0] != 0 causes
an alignment exception (a type of data abort).
A7-54
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 0 1
16 15
Rn
12 11
Rd
SBZ
6 5
1 0 1 1
Rm
A7-55
Thumb Instructions
7.1.34
LDRSB
15
14
13
12
11
10
Rm
Rn
Rd
The LDRSB (Load Register Signed Byte) instruction loads a byte from memory and sign-extends it to form
a 32-bit word, which is written to a general-purpose register.
Syntax
LDRSB
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register containing the second value used in forming the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
Rd = SignExtend(Memory[address,1])
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 0 1
A7-56
16 15
Rn
12 11
Rd
SBZ
4 3
1 1 0 1
Rm
Thumb Instructions
7.1.35
LDRSH
15
14
13
12
11
10
Rm
Rn
Rd
The LDRSH (Load Register Signed Halfword) instruction loads a halfword from memory and sign-extends
it to form a 32-bit word, which is written to a general-purpose register.
Syntax
LDRSH
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register containing the second value used in forming the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
if address[0] == 0
data = Memory[address,2]
else
data = UNPREDICTABLE
Rd = SignExtend(data)
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not halfword-aligned and no data abort occurs, the value written
to the destination register is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bit[0] != 0 causes
an alignment exception (a type of data abort).
A7-57
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 0 1
A7-58
16 15
Rn
12 11
Rd
SBZ
4 3
1 1 1 1
Rm
Thumb Instructions
7.1.36
LSL (1)
15
14
13
12
11
10
immed_5
Rm
Rd
This form of the LSL (Logical Shift Left) instruction is used to provide either the value of a register directly
(LSL #0), or the value of a register multiplied by a constant power of two. Zeros are inserted into the bit
positions vacated by the shift, and the condition code flags are updated, based on the result.
Syntax
LSL
where:
<Rd>
<Rm>
<immed_5>
Architecture version
All T variants
Exceptions
None
Operation
if immed_5 == 0
C Flag = unaffected
Rd = Rm
else /* immed_5 > 0 */
C Flag = Rm[32 - immed_5]
Rd = Rm Logical_Shift_Left immed_5
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
V Flag = unaffected
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 1
16 15
SBZ
12 11
Rd
immed_5
6 5
0 0 0
Rm
A7-59
Thumb Instructions
7.1.37
LSL (2)
15
14
13
12
11
10
Rs
Rd
This form of LSL is used to provide the value of a register multiplied by a variable power of two. Zeros are
inserted into the vacated bit positions. The condition code flags are updated, based on the result.
Syntax
LSL
<Rd>, <Rs>
where:
<Rd>
Contains the value to be shifted, and is the destination register for the result of the operation.
<Rs>
Is the register containing the shift value. The value is held in the least significant byte.
Architecture version
All T variants
Exceptions
None
Operation
if Rs[7:0] == 0
C Flag = unaffected
Rd = unaffected
else if Rs[7:0] < 32 then
C Flag = Rd[32 - Rs[7:0]]
Rd = Rd Logical_Shift_Left Rs[7:0]
else if Rs[7:0] == 32 then
C Flag = Rd[0]
Rd = 0
else /* Rs[7:0] > 32 */
C Flag = 0
Rd = 0
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
V Flag = unaffected
A7-60
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 1
16 15
SBZ
12 11
Rd
Rs
6 5
0 0 0 1
Rd
A7-61
Thumb Instructions
7.1.38
LSR (1)
15
14
13
12
11
10
immed_5
Rm
Rd
This form of the LSR (Logical Shift Right) instruction is used to provide the unsigned value of a register,
divided by a constant power of two. LSR performs a logical shift right of the value of register <Rm>, and
zeros are inserted into the vacated bit positions. The condition code flags are updated, based on the result.
Syntax
LSR
where:
<Rd>
<Rm>
<immed_5>
Specifies the shift amount, in the range 1 to 32. Shifts by 1 to 31 are encoded directly
in immed_5. A shift by 32 is encoded as immed_5 == 0.
Architecture version
All T variants
Exceptions
None
Operation
if immed_5 == 0
C Flag = Rd[31]
Rd = 0
else /* immed_5 > 0 */
C Flag = Rd[immed_5 - 1]
Rd = Rm Logical_Shift_Right immed_5
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
V Flag = unaffected
A7-62
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 1
16 15
SBZ
12 11
Rd
immed_5
6 5
0 1 0
Rm
A7-63
Thumb Instructions
7.1.39
LSR (2)
15
14
13
12
11
10
Rs
Rd
This form of LSR is used to provide the unsigned value of a register divided by a variable power of two.
Zeros are inserted into the vacated bit positions. The condition code flags are updated, based on the result.
Syntax
LSR
<Rd>, <Rs>
where:
<Rd>
Contains the value to be shifted, and is the destination register for the result of the operation.
<Rs>
Is the register containing the shift value. The value is held in the least significant byte.
Architecture version
All T variants
Exceptions
None
Operation
if Rs[7:0] == 0 then
C Flag = unaffected
Rd = unaffected
else if Rs[7:0] < 32 then
C Flag = Rd[Rs[7:0] - 1]
Rd = Rd Logical_Shift_Right Rs[7:0]
else if Rs[7:0] == 32 then
C Flag = Rd[31]
Rd = 0
else /* Rs[7:0] > 32 */
C Flag = 0
Rd = 0
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
V Flag = unaffected
A7-64
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 1
16 15
SBZ
12 11
Rd
Rs
6 5
0 0 1 1
Rd
A7-65
Thumb Instructions
7.1.40
MOV (1)
15
14
13
12
11
10
Rd
immed_8
This form of the MOV (Move) instruction moves a large immediate value to a register. The condition code
flags are updated, based on the result.
Syntax
MOV
<Rd>, #<immed_8>
where:
<Rd>
<immed_8>
Architecture version
All T variants
Exceptions
None
Operation
Rd = immed_8
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = unaffected
V Flag = unaffected
<Rd>, #<immed_8>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 1 1 0 1 1
A7-66
16 15
SBZ
12 11 10 9 8
Rd
0 0 0 0
immed_8
Thumb Instructions
7.1.41
MOV (2)
15
14
13
12
11
10
Rn
Rd
This form of MOV is used to move a value from one low register to another, and the flags are set according
to that value.
Syntax
MOV
<Rd>, <Rn>
where:
<Rd>
<Rn>
Architecture Version
All T variants
Exceptions
None
Operation
Rd = Rn
N Flag =
Z Flag =
C Flag =
V Flag =
Rd[31]
if Rd == 0 then 1 else 0
0
0
Notes
Encoding
<Rd>, <Rn>, #0
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 0 1 0 0 1
16 15
Rn
12 11 10 9
Rd
6 5
1 0
0 0 0 0 0 0 0 0 0 0 0 0
A7-67
Thumb Instructions
7.1.42
MOV (3)
15
14
13
12
11
10
H1
H2
Rm
Rd
This form of MOV is used to move a value to, from, or between high registers. Unlike the low register MOV
instruction described in MOV (2) on page A7-67, this instruction does not change the flags.
Syntax
MOV
<Rd>, <Rm>
where:
<Rd>
Is the destination register for the operation. It can be any of R0 to R15, and its number is
encoded in the instruction in H1 (most significant bit) and Rd (remaining three bits).
<Rm>
Is the register containing the value to be copied. It can be any of R0 to R15, and its number
is encoded in the instruction in H2 (most significant bit) and Rm (remaining three bits).
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rm
Usage
The instruction MOV PC,R14 can be used as a subroutine return instruction if it is known that the caller is
also a Thumb routine. However, it is more usual to use BX R14 (see BX on page A7-32), which works
regardless of whether the caller is an ARM routine or a Thumb routine.
In T variants of ARM architecture 4, the instruction MOV R14,PC is often used to set up a return link value
in R14 for a call to an ARM routine. In T variants of ARM architecture 5 and above, there are more efficient
ways of doing this. See BX on page A7-32 for more details.
Notes
Operand restriction If a low register is specified for <Rd> and <Rm> (H1==0 and H2==0), the result is
UNPREDICTABLE.
A7-68
Thumb Instructions
<Rd>, <Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 0
16 15 14
SBZ
H1
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0 H2
Rm
There are slight differences when the instruction accesses the PC, because of the different definitions of the
PC when executing ARM and THUMB code.
A7-69
Thumb Instructions
7.1.43
MUL
15
14
13
12
11
10
Rm
Rd
The MUL (Multiply) instruction multiplies signed or unsigned variables to produce a 32-bit result. The
condition code flags are updated, based on the result.
Syntax
MUL
<Rd>, <Rm>
where:
<Rd>
Contains the value to be multiplied with the value of <Rm>, and is also the destination
register for the operation.
<Rm>
Is the register containing the value to be multiplied with the value of <Rd>.
Architecture version
All T variants
Exceptions
None
Operation
Rd = (Rm
N Flag =
Z Flag =
C Flag =
V Flag =
A7-70
* Rd)[31:0]
Rd[31]
if Rd == 0 then 1 else 0
unaffected
/* See "C flag" note */
unaffected
Thumb Instructions
Notes
Operand restriction Specifying the same register for <Rd> and <Rm> has UNPREDICTABLE results.
Early termination
Signed and unsigned As the MUL instruction produces only the lower 32 bits of the 64-bit product, MUL
gives the same answer for multiplication of both signed and unsigned numbers.
C flag
The MUL instruction is defined to leave the C flag unchanged in ARM architecture
version 5 and above. In earlier versions of the architecture, the value of the C flag
was UNPREDICTABLE after a MUL instruction.
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 0 0 0 0 1
16 15
Rd
12 11
SBZ
Rd
6 5
1 0 0 1
Rm
Note
The following instruction is not a suitable alternative, as it violates the operand restriction on the ARM
instruction (see MUL on page A4-66) and might have the wrong early termination behavior:
MULS
A7-71
Thumb Instructions
7.1.44
MVN
15
14
13
12
11
10
Rm
Rd
The MVN (Move NOT) instruction is used to complement a register value, often to form a bit mask. The
condition code flags are updated, based on the result.
Syntax
MVN
<Rd>, <Rm>
where:
<Rd>
<Rm>
Is the register containing the value whose ones complement is written to <Rd>.
Architecture version
All T variants
Exceptions
None
Operation
Rd = NOT
N Flag =
Z Flag =
C Flag =
V Flag =
Rm
Rd[31]
if Rd == 0 then 1 else 0
unaffected
unaffected
<Rd>, <Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 1 1 1
A7-72
16 15
SBZ
12 11 10 9 8
Rd
4 3
0 0 0 0 0 0 0 0
Rm
Thumb Instructions
7.1.45
NEG
15
14
13
12
11
10
Rm
Rd
The NEG (Negate) instruction negates the value of one register and stores the result in a second register. The
condition code flags are updated (based on the result).
Syntax
NEG
<Rd>, <Rm>
where:
<Rd>
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
Rd = 0
N Flag
Z Flag
C Flag
V Flag
=
=
=
=
Rm
Rd[31]
if Rd == 0 then 1 else 0
NOT BorrowFrom(0 - Rm)
OverflowFrom(0 - Rm)
<Rd>, <Rm>, #0
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 0 0 1 1 1
16 15
Rm
12 11 10 9
Rd
6 5
1 0
0 0 0 0 0 0 0 0 0 0 0 0
A7-73
Thumb Instructions
7.1.46
ORR
15
14
13
12
11
10
Rm
Rd
The ORR (Logical OR) instruction performs a bitwise OR of the values in two registers. The condition code
flags are updated, based on the result.
Syntax
ORR
<Rd>, <Rm>
where:
<Rd>
<Rm>
Is the register containing the value that is ORed with the value of <Rd>. The operation is a
bitwise inclusive OR.
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd OR Rm
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = unaffected
V Flag = unaffected
Operation
ORRS
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 0 1
A7-74
16 15
Rd
12 11 10 9 8
Rd
4 3
0 0 0 0 0 0 0 0
Rm
Thumb Instructions
7.1.47
POP
15
14
13
12
11
10
register_list
The POP (Pop Multiple Registers) instruction loads a subset (or possibly all) of the general-purpose
registers R0-R7 and the PC from the stack.
The general-purpose registers loaded can include the PC. If they do, the word loaded for the PC is treated
as an address and a branch occurs to that address. In ARM architecture version 5 and above, bit[0] of the
loaded value determines whether execution continues after this branch in ARM state or in Thumb state, as
though the following instruction had been executed:
BX (loaded_value)
In T variants of architecture version 4, bit[0] of the loaded value is ignored and execution continues in
Thumb state, as though the following instruction had been executed:
MOV PC,(loaded_value)
Syntax
POP
<registers>
where:
<registers>
Is the list of registers, separated by commas and surrounded by { and }. The list is
encoded in the register_list field of the instruction, by setting bit[i] to 1 if register
Ri is included in the list and to 0 otherwise, for each of i=0 to 7. The R bit (bit[8])
is set to 1 if the PC is in the list and to 0 otherwise.
At least one register must be loaded. If bits[8:0] are all zero, the result is
UNPREDICTABLE.
The registers are loaded in sequence, the lowest-numbered register from the lowest
memory address (start_address), through to the highest-numbered register
from the highest memory address (end_address). If the PC is specified in the
register list (opcode bit[8] is set), the instruction causes a branch to the address
(data) loaded into the PC.
The <start_address> is the value of the SP.
Subsequent addresses are formed by incrementing the previous address by four.
One address is produced for each register that is specified in <registers>.
The end_address value is four less than the sum of the value of the SP and four
times the number of registers specified in <registers>.
The SP register is incremented by four times the numbers of registers in
<registers>.
A7-75
Thumb Instructions
Architecture version
All T variants
Exceptions
Data Abort
Operation
start_address = SP
end_address = SP + 4*(R + Number_Of_Set_Bits_In(register_list))
address = start_address
for i = 0 to 7
if register_list[i] == 1 then
Ri = Memory[address,4]
address = address + 4
if R == 1 then
value = Memory[address,4]
PC = value AND 0xFFFFFFFE
if (architecture version 5 or above) then
T Bit = value[0]
address = address + 4
assert end_address = address
SP = end_address
Usage
The POP instruction is useful for stack operations. A POP instruction with the PC in the register list can be
used for an efficient procedure exit, as it restores saved registers, loads the PC with the return address, and
updates the stack pointer with a single instruction.
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
CPSR
Alignment
A7-76
Thumb Instructions
The time order of the accesses to individual words of memory generated by this instruction
is only defined in some circumstances. See Data accesses to memory-mapped I/O on
page A2-32 for details.
SP!, <registers>
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9
1 1 1 0 1 0 0 0 1 0 1 1 1 1 0 1 R 0 0 0 0 0 0 0
register_list
A7-77
Thumb Instructions
7.1.48
PUSH
15
14
13
12
11
10
register_list
The PUSH (Push Multiple Registers) instruction stores a subset (or possibly all) of the general-purpose
registers R0-R7 and the LR to the stack.
Syntax
PUSH
<registers>
where:
<registers>
The registers are stored in sequence, the lowest-numbered register to the lowest
memory address (start_address), through to the highest-numbered register to
the highest memory address (end_address)
The start_address is the value of the SP minus 4 times the number of registers
to be stored.
Subsequent addresses are formed by incrementing the previous address by four.
One address is produced for each register that is specified in <registers>.
The end_address value is four less than the original value of SP.
The SP register is decremented by four times the numbers of registers in
<registers>.
Architecture version
All T variants
Exceptions
Data Abort
A7-78
Thumb Instructions
Operation
start_address = SP - 4*(R + Number_Of_Set_Bits_In(register_list))
end_address = SP - 4
address = start_address
for i = 0 to 7
if register_list[i] == 1
Memory[address,4] = Ri
address = address + 4
if R == 1
Memory[address,4] = LR
address = address + 4
assert end_address == address - 4
SP = SP - 4*(R + Number_Of_Set_Bits_In(register_list))
Usage
PUSH is useful for stack operations. A PUSH instruction with the LR in the register list can be used for an
efficient procedure entry, as it saves registers (including the return address) on the stack and updates the
stack pointer with a single instruction. A matching POP instruction can be used later to return from the
procedure.
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
Time order
The time order of the accesses to individual words of memory generated by this instruction
is only defined in some circumstances. See Data accesses to memory-mapped I/O on
page A2-32 for details.
SP!, <registers>
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9
1 1 1 0 1 0 0 1 0 0 1 0 1 1 0 1 0 R 0 0 0 0 0 0
register_list
A7-79
Thumb Instructions
7.1.49
ROR
15
14
13
12
11
10
Rs
Rd
The ROR (Rotate Right Register) instruction is used to provide the value of a register rotated by a variable
value (from another register). The bits that are rotated off the right end are inserted into the vacated bit
positions on the left. The condition code flags are updated, based on the result.
Syntax
ROR
<Rd>, <Rs>
where:
<Rd>
Contains the value to be rotated, and is also the destination register for the operation.
<Rs>
Is the register containing the rotation applied to the value of <Rd>. The value of the rotation
is stored in the least significant byte.
Architecture version
All T variants
Exceptions
None
Operation
if Rs[7:0] == 0 then
C Flag = unaffected
Rd = unaffected
else if Rs[4:0] == 0 then
C Flag = Rd[31]
Rd = unaffected
else /* Rs[4:0] > 0 */
C Flag = Rd[Rs[4:0] - 1]
Rd = Rd Rotate_Right Rs[4:0]
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
V Flag = unaffected
A7-80
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 1 1
16 15
SBZ
12 11
Rd
Rs
6 5
0 1 1 1
Rd
A7-81
Thumb Instructions
7.1.50
SBC
15
14
13
12
11
10
Rm
Rd
The SBC (Subtract with Carry) instruction can be used to synthesize multi-word subtraction. It subtracts the
value of register <Rm> and the value of NOT(Carry Flag) from the value of register <Rd>. The condition
code flags are updated, based on the result.
Syntax
SBC
<Rd>, <Rm>
where:
<Rd>
Contains the first operand for the subtraction, and is also the destination register for the
operation.
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd - Rm - NOT(C Flag)
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rd - Rm - NOT(C Flag))
V Flag = OverflowFrom(Rd - Rm - NOT(C Flag))
A7-82
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 0 1 1 0 1
16 15
Rd
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-83
Thumb Instructions
7.1.51
STMIA
15
14
13
12
11
10
Rn
register_list
The STMIA (Store Multiple Increment After) instruction stores a non-empty subset, or possibly all, of the
general-purpose registers to sequential memory locations.
Syntax
STMIA
<Rn>!, <registers>
where:
<Rn>
<registers>
The registers are stored in sequence, the lowest-numbered register to the lowest
memory address (start_address), through to the highest-numbered register to
the highest memory address (end_address).
The start_address is the value of the base register <Rn>. Subsequent
addresses are formed by incrementing the previous address by four. One address is
produced for each register that is specified in <registers>.
The end_address value is four less than the sum of the value of the base register
and four times the number of registers specified in <registers>.
Finally, the base register <Rn> is incremented by 4 times the numbers of registers
in <registers>.
Architecture version
All T variants
Exceptions
Data Abort
A7-84
Thumb Instructions
Operation
start_address = Rn
end_address = Rn + (Number_Of_Set_Bits_In(register_list) * 4) - 4
address = start_address
for i = 0 to 7
if register_list[i] == 1
Memory[address,4] = Ri
address = address + 4
assert end_address == address - 4
Rn = Rn + (Number_Of_Set_Bits_In(register_list) * 4)
Usage
STMIA is useful as a block store instruction. Combined with LDMIA (Load Multiple), it allows efficient
block copy.
Notes
Operand restrictions
If <Rn> is specified in <registers> and writeback is specified:
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
Store Multiple instructions ignore the least significant two bits of address.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception.
Time order
The time order of the accesses to individual words of memory generated by this instruction
is only defined in some circumstances. See Data accesses to memory-mapped I/O on
page A2-32 for details.
<Rn>!, <registers>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 1 0 0 0 1 0 1 0
16 15 14 13 12 11 10 9
Rn
0 0 0 0 0 0 0 0
register_list
A7-85
Thumb Instructions
7.1.52
STR (1)
15
14
13
12
11
10
immed_5
Rn
Rd
This form of the STR (Store Register) instruction allows 32-bit data from a general-purpose register to be
stored to memory. The addressing mode is useful for accessing structure (record) fields. With an offset of
zero, the address produced is the unaltered value of the base register <Rn>.
Syntax
STR
where:
<Rd>
<Rn>
<immed_5> Is a 5-bit value that is multiplied by 4 and added to the value of <Rn> to form the memory
address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + (immed_5 * 4)
if address[1:0] == 0b00
Memory[address,4] = Rd
else
Memory[address,4] = UNPREDICTABLE
A7-86
Thumb Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not word-aligned and no data abort occurs, the value written to
memory is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception (a type of data abort).
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 0 1 1 0 0 0
16 15
Rn
12 11 10 9
Rd
0 0 0 0 0
immed_5
1 0
0 0
A7-87
Thumb Instructions
7.1.53
STR (2)
15
14
13
12
11
10
Rm
Rn
Rd
This form of STR allows 32-bit data from a general-purpose register to be stored to memory. The addressing
mode is useful for pointer + large offset arithmetic, and for accessing a single element of an array.
Syntax
STR
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register containing the second value used in forming the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
if address[1:0] == 0b00
Memory[address,4] = Rd
else
Memory[address,4] = UNPREDICTABLE
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not word-aligned and no data abort occurs, the value written to
memory is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception (a type of data abort).
A7-88
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 1 1 1 0 0 0
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-89
Thumb Instructions
7.1.54
STR (3)
15
14
13
12
11
10
Rd
immed_8
This form of STR allows 32-bit data from a general-purpose register to be stored to memory. The addressing
mode is useful for accessing stack data. In this case, STR stores a word from register <Rd> to memory.
Syntax
STR
where:
<Rd>
SP
Is the stack pointer. Its value is used to calculate the memory address.
<immed_8> Is an 8-bit value that is multiplied by 4 and added to the value of the SP to form the memory
address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = SP + (immed_8 * 4)
if address[1:0] == 0b00
Memory[address,4] = Rd
else
Memory[address,4] = UNPREDICTABLE
A7-90
Thumb Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not word-aligned and no data abort occurs, the value written to
memory is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor), and alignment checking is enabled, an address with bits[1:0] != 0b00
causes an alignment exception (a type of data abort).
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15
1 1 1 0 0 1 0 1 1 0 0 0 1 1 0 1
12 11 10 9
Rd
0 0
immed_8
1 0
0 0
A7-91
Thumb Instructions
7.1.55
STRB (1)
15
14
13
12
11
10
immed_5
Rn
Rd
This form of the STRB (Store Register Byte) instruction allows 8-bit data from a general-purpose register
to be stored to memory. The addressing mode is useful for accessing structure (record) fields.
With an offset of zero, the address produced is the unaltered value of the base register <Rn>.
Syntax
STRB
where:
<Rd>
<Rn>
<immed_5> Is a 5-bit immediate value that is added to the value of <Rn> to form the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + immed_5
Memory[address,1] = Rd[7:0]
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 0 1 1 1 0 0
A7-92
16 15
Rn
12 11 10 9 8
Rd
0 0 0 0 0 0 0
immed_5
Thumb Instructions
7.1.56
STRB (2)
15
14
13
12
11
10
Rm
Rn
Rd
This form of STRB allows 8-bit data from a general-purpose register to be stored to memory. The
addressing mode is useful for pointer + large offset arithmetic, and for accessing a single element of an
array.
Syntax
STRB
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register whose value is added to <Rn> to form the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
Memory[address,1] = Rd[7:0]
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 1 1 1 1 1 0 0
16 15
Rn
12 11 10 9
Rd
6 5
0 0 0 0 0 0 0 0
Rm
A7-93
Thumb Instructions
7.1.57
STRH (1)
15
14
13
12
11
10
immed_5
Rn
Rd
This form of the STRH (Store Register Halfword) instruction allows 16-bit data from a general-purpose
register to be stored to memory. The addressing mode is useful for accessing structure (record) fields. With
an offset of zero, the address produced is the unaltered value of the base register <Rn>.
Syntax
STRH
where:
<Rd>
<Rn>
<immed_5> Is a 5-bit immediate value that is multiplied by two and added to the value of <Rn> to form
the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + (immed_5 * 2)
if address[1:0] == 0
Memory[address,2] = Rd[15:0]
else
Memory[address,2] = UNPREDICTABLE
A7-94
Thumb Instructions
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not halfword-aligned and no data abort occurs, the value written
to memory is UNPREDICTABLE.
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bit[0] != 0 causes
an alignment exception (a type of data abort).
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 1 0 0
16 15
Rn
12 11 10 9
Rd
0 0
7 6
4 3
1 0
immed
immed
1 0 1 1
0
[4:3]
[2:0]
A7-95
Thumb Instructions
7.1.58
STRH (2)
15
14
13
12
11
10
Rm
Rn
Rd
This form of STRH allows 16-bit data from a general-purpose register to be stored to memory. The
addressing mode is useful for pointer + large offset arithmetic and for accessing a single element of an array.
Syntax
STRH
where:
<Rd>
<Rn>
Is the register containing the first value used in forming the memory address.
<Rm>
Is the register whose value is added to <Rn> to form the memory address.
Architecture version
All T variants
Exceptions
Data Abort
Operation
address = Rn + Rm
if address[1:0] == 0
Memory[address,2] = Rd[15:0]
else
Memory[address,2] = UNPREDICTABLE
Notes
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Alignment
If the memory address is not halfword-aligned and no data abort occurs, the value written
to memory is UNPREDICTABLE
If an implementation includes a System Control coprocessor (see Chapter B2 The System
Control Coprocessor) and alignment checking is enabled, an address with bit[0] != 0 causes
an alignment exception (a type of data abort).
A7-96
Thumb Instructions
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 1 0 0 0
16 15
Rn
12 11
Rd
SBZ
6 5
1 0 1 1
1 0
Rm
A7-97
Thumb Instructions
7.1.59
SUB (1)
15
14
13
12
11
10
immed_3
Rn
Rd
This form of the SUB (Subtract) instruction subtracts a small constant value from the value of a register and
stores the result in a second register. The condition code flags are updated, based on the result.
Syntax
SUB
where:
<Rd>
<Rn>
<immed_3>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rn - immed_3
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - immed_3)
V Flag = OverflowFrom(Rn - immed_3)
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 0 0 1 0 1
A7-98
16 15
Rn
12 11 10 9 8
Rd
4 3
0 0 0 0 0 0 0 0 0 immed_3
Thumb Instructions
7.1.60
SUB (2)
15
14
13
12
11
10
Rd
immed_8
This form of SUB subtracts a large immediate value from the value of a register and stores the result back
in the same register. The condition code flags are updated, based on the result.
Syntax
SUB
<Rd>, #<immed_8>
where:
<Rd>
Is the register containing the first operand for the subtraction, and is also the
destination register for the operation.
<immed_8>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rd - immed_8
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rd - immed_8)
V Flag = OverflowFrom(Rd - immed_8)
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 1 0 0 1 0 1
16 15
Rd
12 11 10 9
Rd
0 0 0 0
immed_8
A7-99
Thumb Instructions
7.1.61
SUB (3)
15
14
13
12
11
10
Rm
Rn
Rd
This form of SUB subtracts the value of one register from the value of a second register and stores the result
in a third register. The condition code flags are updated, based on the result.
Syntax
SUB
where:
<Rd>
<Rn>
<Rm>
Architecture version
All T variants
Exceptions
None
Operation
Rd = Rn - Rm
N Flag = Rd[31]
Z Flag = if Rd == 0 then 1 else 0
C Flag = NOT BorrowFrom(Rn - Rm)
V Flag = OverflowFrom(Rn - Rm)
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 0 0 1 0 1
A7-100
16 15
Rn
12 11 10 9 8
Rd
4 3
0 0 0 0 0 0 0 0
Rm
Thumb Instructions
7.1.62
SUB (4)
15
14
13
12
11
10
immed_7
This form of SUB decrements the SP by four times a 7-bit immediate (that is, by a multiple of 4 in the range
0 to 508). The condition codes are not affected.
Syntax
SUB
SP, #<immed_7> * 4
where:
SP
Indicates the stack pointer. The result of the operation is also stored in the SP.
<immed_7>
Is a 7-bit immediate value that is multiplied by 4 and then subtracted from the value
of the stack pointer.
Architecture version
All T variants
Exceptions
None
Operation
SP = SP - (immed_7 << 2)
Usage
For the Full Descending stack which the Thumb instruction set is designed to use, decrementing the SP is
used to allocate extra memory variables on the top of the stack.
Notes
Alternative syntax
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9
1 1 1 0 0 0 1 0 0 1 0 0 1 1 0 1 1 1 0 1 1 1 1 1 0
immed_7
A7-101
Thumb Instructions
7.1.63
SWI
15
14
13
12
11
10
immed_8
The SWI (Software Interrupt) instruction is used as an operating system service call. A SWI exception is
generated, which is handled by an operating system to provide the requested service. See Exceptions on
page A2-13.
Syntax
SWI
<immed_8>
where:
<immed_8>
Is an 8-bit immediate value that is put into bits[7:0] of the instruction. This value is
ignored by the processor, but can be used by an operating systems SWI exception
handler to determine which operating system service is being requested.
Architecture version
All T variants
Exceptions
Software Interrupt
Operation
R14_svc
= address of next instruction after the SWI instruction
SPSR_svc = CPSR
CPSR[4:0] = 0b10011
/* Enter Supervisor mode */
CPSR[5]
= 0
/* Execute in ARM state */
/* CPSR[6] is unchanged */
CPSR[7]
= 1
/* Disable normal interrupts */
if high vectors configured then
PC
= 0xFFFF0008
else
PC
= 0x00000008
<immed_8>
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8
1 1 1 0 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
A7-102
immed_8
Thumb Instructions
7.1.64
TST
15
14
13
12
11
10
Rm
Rn
The TST (Test) instruction is used to determine whether a particular subset of bits in a register includes at
least one set bit. A very common use for TST is to test whether a single bit is set or clear. The condition
code flags are updated, based on the result.
Syntax
TST
<Rn>, <Rm>
where:
<Rn>
<Rm>
Is the register whose value is logically ANDed with the value of <Rn>.
Architecture version
All T variants
Exceptions
None
Operation
alu_out = Rn AND Rm
N Flag = alu_out[31]
Z Flag = if alu_out == 0 then 1 else 0
C Flag = unaffected
V Flag = unaffected
<Rn>, <Rm>
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 0 0 0 0 1 0 0 0 1
16 15
Rn
12 11 10 9
SBZ
6 5
0 0 0 0 0 0 0 0
Rm
A7-103
Thumb Instructions
7.2
A7-104
Instruction
v4T, v4TxM
v5T, v5TxM
ADC
Yes
Yes
Yes
Yes
AND
Yes
Yes
Yes
Yes
B (both forms)
Yes
Yes
BIC
Yes
Yes
BKPT
No
Yes
BL
Yes
Yes
No
Yes
BX
Yes
Yes
CMN
Yes
Yes
Yes
Yes
EOR
Yes
Yes
LDMIA
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
LDRSB
Yes
Yes
LDRSH
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Thumb Instructions
Instruction
v4T, v4TxM
v5T, v5TxM
MUL
Yes
Yes
MVN
Yes
Yes
NEG
Yes
Yes
ORR
Yes
Yes
POP
Yes
Yes
PUSH
Yes
Yes
ROR
Yes
Yes
SBC
Yes
Yes
STMIA
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
SWI
Yes
Yes
TST
Yes
Yes
A7-105
Thumb Instructions
A7-106
Chapter A8
The 26-bit Architectures
This chapter describes the differences between the 32-bit and 26-bit architectures. It contains the following
sections:
Note
The information in this chapter is to help with backwards-compatibility issues in existing systems.
Programmers starting new projects are strongly encouraged to use only the 32-bit facilities.
A8-1
8.1
except for ARMv3G, all variants of ARM architecture version 3 implement the 26-bit address space
all non-T variants of ARM architecture version 4 and above can optionally implement the 26-bit
address space.
This chapter describes the differences between the 26-bit and 32-bit architectures, and how the
backwards-compatibility features are used.
There are several differences between the 26-bit and the 32-bit architectures:
Program counter
The 26-bit architectures implement only a 24-bit program counter in R15, which
allows 64MB of program space. The 32-bit architectures have a 30-bit program
counter in R15 which allows 4GB of program space on 32-bit architectures.
Processor modes
User (0b00)
FIQ (0b01)
IRQ (0b10)
Supervisor (0b11).
Register 15
In the 26-bit architectures, the following are also stored in register 15:
CPSR/SPSR
Exceptions
Branches
A8-2
Together, these differences make up the fundamental distinction between 26-bit and 32-bit architectures:
26-bit architectures
All process status (namely the condition flags, interrupt status and processor mode) can be
preserved across subroutine calls and nested exceptions without adding any instructions to
the entry or exit sequence.
32-bit architectures
This process status functionality is given up to allow 32-bit instruction addresses to be used.
For exceptions, processor status is preserved in the SPSRs, and if nested exceptions using
the same SPSR can occur, extra instructions are used to preserve this status in memory. For
subroutine calls, processor status can be preserved across the subroutine call by using extra
instructions, but this is not normally done.
A8-3
8.2
Format of register 15
31 30 29 28 27 26 25
N Z C V I F
Program Counter
M1 M0
Bits[25:2] are collectively known as the Program Counter (PC). Because the PC occupies only 24 bits of
register 15, only 224 instructions (226 bytes) can be addressed, giving a maximum addressable program size
of 64MB.
Bits[31:26] and bits[1:0] are collectively known as the Program Status Register (PSR).
The N, Z, C, V, I, and F bits have the same meaning in both 26-bit and 32-bit architectures. M[1:0] also have
the same meaning in both architectures.
Abort, Undefined, and System mode are not supported in 26-bit architectures. Aborts and Undefined
Instruction exceptions have exactly the same actions in both modes, except that in 26-bit architectures,
Supervisor mode is entered instead of Abort or Undefined mode.
The precise effect of an exception on a 26-bit architecture can be derived from the rules in Exceptions on
page A2-13, as follows:
The banked version of R14 has bits[25:2] set to the specified address, and bits[31:26, 1, 0] set to
copies of the corresponding bits in R15.
The I, F, M1, and M0 bits are modified in the same way as CPSR[7], CPSR[6], CPSR[1], and
CPSR[0] respectively, on a 32-bit architecture.
The I, F and M[1:0] bits cannot be written directly when the processor is in User mode. In User mode they
are only changed by an exception occurring.
8.2.1
Reading register 15
In 26-bit architectures, the value of R15 is read in five different ways:
Most importantly, if R15 has an UNPREDICTABLE value in the 32-bit architecture, it also has an
when used in the same way in the 26-bit architecture.
UNPREDICTABLE value
A8-4
If R15 is specified in bits[19:16] of an instruction (and its value is not UNPREDICTABLE), only the PC
(bits[25:2]) is used. All other bits read as zero.
If R15 is specified in bits[3:0] of an instruction (and its value is not UNPREDICTABLE), all 32 bits are
used.
If R15 is stored using STR or STM, the value of the PC (bits[25:2]) is IMPLEMENTATION DEFINED, but
all 32 bits of the register are stored.
All 32 bits are stored in the Link register (R14) after a Branch with Link instruction or an exception
entry.
8.2.2
Writing register 15
In 26-bit architectures, the value of R15 is written in three different ways:
The following instructions only write the PC part of R15, leaving the PSR part unchanged:
LDR instructions
The following instructions write both the PC and the PSR part of R15:
Variants of the CMP, CMN, TST, and TEQ instructions write just the PSR part of R15 and leave the
PC part unchanged. These instruction variants are described 26-bit PSR update instructions on
page A8-6.
These read/write rules mean that R15 is used in three basic ways:
When it is the Rn specifier in data-processing instructions, or the base address for load and store
instructions, only the value of the program counter is used, to simplify PC-relative addressing and
position-independent code.
When it is the Rm specifier in data-processing instructions, all 32 bits are used in order to allow all
process status to be restored after a subroutine call or exception by subroutine-return instructions
such as:
MOVS PC, LR and LDM..., PC}^
These instructions are UNPREDICTABLE in User mode on 32-bit architectures, but are legal on 26-bit
architectures, as they are used to restore the condition code flags on procedure exit.
All 32 bits are saved in the Link register, to preserve the PC and the PSR across subroutine calls and
exceptions.
A8-5
8.3
27 26 25 24 23 22 21 20 19
cond
0 0 I 1 0
opc
16 15
Rn
12 11
1 1 1 1
shifter_operand
In 26-bit architectures, the MSR and MRS instructions are not supported. Instead, variants of the CMN, CMP,
TEQ and TST instructions are used to write just the PSR part of R15 without affecting the PC part. These
26-bit-only variants are called CMNP, CMPP, TEQP and TSTP, and are distinguished by having instruction
bits[15:12] equal to 0b1111. These bits are equal to 0b0000 in the normal variants of these instructions.
These instructions write their ALU result directly to the PSR part of register 15 (only N, Z, C, and V are
affected in User mode).
When the processor is in User mode, only the condition codes are affected. All other modes allow all PSR
bits to be altered.
8.3.1
Syntax
CMN{<cond>}P
CMP{<cond>}P
TEQ{<cond>}P
TST{<cond>}P
Rn,
Rn,
Rn,
Rn,
<shifter_operand>
<shifter_operand>
<shifter_operand>
<shifter_operand>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rn>
Specifies the register that contains the first operand for the instruction.
<shifter_operand>
Specifies the second operand for the instruction. Its options are described in Addressing
Mode 1 - Data-processing operands on page A5-2, including how each option causes the I
bit (bit 25) and the <shifter_operand> bits (bits 11:0) to be set in the instruction.
8.3.2
Exceptions
None
A8-6
8.3.3
Operation
if ConditionPassed(<cond>) then
case <opc> of
0b00 /* TSTP */
<alu_out> = Rn AND <shifter_operand>
0b01 /* TEQP */
<alu_out> = Rn EOR <shifter_operand>
0b10 /* CMPP */
<alu_out> = Rn - <shifter_operand>
0b11 /* CMNP */
<alu_out> = Rn + <shifter_operand>
endcase
if R15[1:0] == 0b00 then
/* M[1:0] == 0b00, User mode */
R15[31:28] = <alu_out>[31:28]
/* update just NZCV */
else
/* a privileged mode */
R15[31:26] = <alu_out>[31:26]
/* update NZCVIF and ... */
R15[1:0] = <alu_out>[1:0]
/* ... update M[1:0] */
A8-7
8.4
Address exceptions
In 26-bit architectures, all data addresses are checked to ensure that they are between 0 and 64MB. If a data
address is produced with a 1 in any of the top 6 bits, an address exception is generated. When an address
exception is generated, the following actions are performed:
R14_svc[25:2]
=
R14_svc[31:26,1,0]
=
M[1:0] =
0b11
F
=
unchanged
I
=
1
PC
=
0x14
address of instruction + 8
R15[31:26,1,0]
; Supervisor mode
; (normal) interrupts disabled
The address of the instruction which caused the address exception is the value in R14 minus 8.
8.4.1
This restores both the PC and PSR (from R14_svc) and returns to the instruction that generated the address
exception.
A8-8
8.5
Mode
Accessible registers
0b00000
User_26
0b00001
FIQ_26
0b00010
IRQ_26
0b00011
SVC_26
0b10000
User_32
0b10001
FIQ_32
0b10010
IRQ_32
0b10011
SVC_32
0b10111
Abort_32
0b11011
Undef_32
0b11111
System_32
A8-9
Note
The MRS and MSR instructions are supported in all cases, despite the fact that they do not exist in pure 26-bit
architectures. This is to assist conversion to a 32-bit architecture, as the CMNP, CMPP, TEQP, and TSTP
instructions cannot enter a 32-bit mode from a 26-bit mode.
If an MSR instruction which lies outside the 26-bit address space is used to switch into a 26-bit mode, the
results are UNPREDICTABLE.
The results of an MSR instruction which switches between a 32-bit mode and a 26-bit mode (in either
direction) are also UNPREDICTABLE if it is executed at any point where predictable subsequent execution can
reach either of the following:
a branch instruction whose target addresses in the 26-bit and 32-bit address spaces are different.
For this purpose, predictable subsequent execution is as defined in Other uses for IMBs on page A2-30.
8.5.1
PROG32
DATA32.
Note
If an implementation does not support these signals but does provide 32-bit modes, it must behave as though
both signals were 1.
32-bit configuration
1.
If PROG32 is active and DATA32 is active, the processor switches to a 32-bit mode when
processing exceptions (including Reset), using the _32 modes for handling all exceptions. This is
called a 32-bit configuration. Abort_32 mode is used for handling memory aborts, and Undef_32 for
handling Undefined Instruction exceptions. A 26-bit mode can be selected by putting a 26-bit mode
number into the M[4:0] bits of the CPSR (either using MSR or an exception return sequence). A
32-bit mode can also be entered from a 26-bit mode using the MSR instruction. Once in a 26-bit mode,
another 26-bit mode can be entered using one of the CMNP, CMPP, TEQP and TSTP instructions, or
the MSR instruction.
If an exception occurs when the processor is in a 26-bit mode, only the PC bits from R15[25:2] are
copied to the link register. The remaining bits in the link register are zeroed. The PSR bits from
R15[31:26] and R15[1:0] are copied into the SPSR, ready for a normal 32-bit return sequence.
2.
If PROG32 is active and DATA32 is not active (32-bit programs with 26-bit data), the result is
UNPREDICTABLE.
A8-10
26-bit configuration
8.5.2
1.
If PROG32 is not active, the processor is locked into 26-bit modes (that is, cannot be placed into a
32-bit mode by any means) and handles exceptions in 26-bit modes. This is called a 26-bit
configuration. In this configuration, CMNP, CMPP, TEQP and TSTP instructions, or the MSR
instruction can be used to switch to 26-bit modes. Attempts to write CPSR bits[4:2] (M[4:2]) are
ignored, stopping any attempts to switch to a 32-bit mode, and SVC_26 mode is used to handle
memory aborts and Undefined Instruction exceptions. The PC is limited to 24 bits, limiting the
addressable program memory to 64MB.
2.
If DATA32 is not active, all data addresses are checked to ensure that they are between 0 and
64MB. If a data address is produced with a 1 in any of the top 6 bits, an address exception is
generated.
If DATA32 is active, full 32-bit addresses can be produced and are not checked for address
exceptions. This allows 26-bit programs to access data in the full 32-bit address space.
Vector exceptions
When the processor is in a 32-bit configuration (PROG32 is active) and in a 26-bit mode (CPSR[4] == 0),
data access (but not instruction fetches) to the exception vectors (address 0x0 to 0x1F) causes a data abort.
This is known as a vector exception.
Vector exceptions are always produced if the exception vectors are written in a 32-bit configuration and a
26-bit mode. It is IMPLEMENTATION DEFINED whether reading the exception vectors in a 32-bit
configuration and a 26-bit mode also causes a vector exception.
Vector exceptions are provided to support 26-bit backwards compatibility. When a vector exception is
generated, it indicates that a 26-bit mode process is trying to install a (26-bit) vector handler. Because the
processor is in a 32-bit configuration, exceptions are handled in a 32-bit mode, so a veneer must be used to
change from the 32-bit exception mode to a 26-bit mode before calling the 26-bit exception handler.
This veneer can be installed on each vector and can switch to a 26-bit mode before calling any 26-bit
handlers.
The return from the 26-bit exception handler might also need to be veneered. Some SWI handlers return
status information in the processor flags, and this information needs to be transferred from the link register
to the SPSR with a return veneer for the SWI handler.
A8-11
A8-12
Chapter A9
ARM Code Sequences
The ARM instruction set is a powerful tool for generating high-performance microprocessor systems. Used
to its full extent, the ARM instruction set allows algorithms to be coded in a very compact and efficient way.
This chapter describes some sample routines that provide insight into the ARM instruction set. It contains
the following sections:
A9-1
9.1
Arithmetic instructions
The following subsections illustrate some ways of using ARM data-processing instructions. The examples
illustrate:
Multiplication by constant
9.1.1
9.1.2
Multiplication by constant
Combinations of shifts, add with shifts, and reverse subtract with shift can be used to perform
multiplications by constants:
A9-2
; multiplication of R0 by 2^n
MOV
R0, R0, LSL #n
; R0 = R0 << n
; multiplication of R0 by 2^n + 1
ADD
R0, R0, R0, LSL #n
; R0 = R0 + (R0 << n)
; multiplication of R0 by 2^n - 1
RSB
R0, R0, R0, LSL #n
; R0 = (R0 << n) - R0
; R0 = R0 * 10 + R1
ADD
R0, R0, R0, LSL #2
ADD
R0, R1, R0, LSL #1
; R0 = R0 * 5
; R0 = R1 + R0 * 2
; R0 = R0 * 100 + R1
ADD
R0, R0, R0, LSL #2
ADD
R0, R0, R0, LSL #2
ADD
R0, R1, R0, LSL #2
; R0 = R0 * 5
; R0 = R0 * 5 (R0 = R0 * 25)
; R0 = R1 + R0 * 4
9.1.3
Multi-precision arithmetic
Arithmetic instructions allow efficient arithmetic on 64-bit or larger objects:
:
:
:
:
R0 and
(R0 is
R2 and
R0 and
add64
ADDS
ADC
R0, R0, R2
R1, R1, R3
sub64
SUBS
SBC
R0, R0, R2
R1, R1, R3
Be aware that in the above example, the V flag is not updated correctly. For example:
R1 = 0x00000001,
R3 = 0x00000001,
R0 = 0x80000000
R2 = 0x7FFFFFFF
R0 R2 overflows as a 32-bit signed number, so the CMPEQ instruction sets the V flag. But (R1, R0)
(R3, R2) does not overflow as a 64-bit number.
An alternative routine exists which updates the V flag correctly, but not the Z flag:
; This routine compares two 64-bit numbers
; On entry: as above
; On exit: N, V and C set correctly
cmp64
SUBS
R4, R0, R2
SBCS
R4, R1, R3
; R4 is destroyed
A9-3
9.1.4
Swapping endianness
Swapping the order of bytes in a word (the endianness) can be performed in two ways:
:
:
R1,
R1,
R0,
R0,
R0,
R1,
R0,
R0,
;
;
;
;
;
R0
R1
R1
R0
R0
=
=
=
=
=
A , B , C , D
A^C,B^D,C^A,D^B
A^C, 0 ,C^A,D^B
D , A , B , C
D , C , B , A
This method is best for swapping the endianness of a large number of words:
; On entry
; On exit
;
byteswap
MOV
ORR
R2, #0xFF
R2, R2, #0xFF0000
A9-4
9.2
Branch instructions
The following subsections show some different ways of controlling the flow of execution in ARM code.
9.2.1
function
; call function
; procedure returns to here
; function body
PC, LR
Another method to return from a called procedure is given in Procedure entry and exit on page A9-10.
9.2.2
Conditional execution
Conditional execution allows if-then-else statements to be collapsed into sequences that do not require
forward branches:
/* C code for Euclids Greatest Common Divisor (GCD)*/
/* Returns the GCD of its two parameters */
int gcd(int a, int b)
{
while (a != b)
if (a > b )
a = a - b ;
else
b = b - a ;
return a ;
}
; ARM assembler code for Euclids Greatest Common Divisor
; On entry: R0 holds a, R1 holds b
; On exit : R0 hold GCD of A and B
gcd
CMP
R0, R1
; compare a and b
SUBGT
R0, R0, R1
; if (a>b) a=a-b (if a==b do nothing)
SUBLT
R1, R1, R0
; if (b>a) b=b-a (if a==b do nothing)
BNE
gcd
; if (a!=b) then keep going
MOV
PC, LR
; return to caller
A9-5
9.2.3
9.2.4
R0, #0
R1, #1
R2, R3, R4
; compare a with 0
; if a is not 0, compare b to 1
; if either was true c = d + e
Loop variables
The Subtract instruction can be used to both decrement a loop counter and set the condition codes to test for
a zero:
MOV
R0, #loopcount
....
SUBS
R0, R0, #1
loop
BNE
....
9.2.5
loop
Multi-way branch
A very simple multi-way branch can be implemented with a single instruction. The following code
dispatches the control of execution to any number of routines, with the restriction that the code to handle
each case of the multi-way branch is the same size, and that size is a power of two bytes:
; Multi-way branch
; On entry: R0 holds the branch index
CMP
ADDLO
R0, #maxindex
; checks the index is in range
PC, PC, R0, LSL #RoutineSizeLog2
; scale index by the log of the size of
; each handler, add to the PC, which points
; 2 instructions beyond this one
; (at Index0Handler), then jump there
IndexOutOfRange
; jump to the error handler
Index0Handler
....
....
Index1Handler
....
....
Index2Handler
....
A9-6
9.3
9.3.1
Linked lists
The following code searches for an element in a linked list that has two elements (a single byte value and a
pointer to the next record) in each record. A null next pointer indicates this is the last element in the list:
; Linked list
; On entry
;
;
; On exit
;
;
llsearch
CMP
LDRNEB
CMPNE
LDRNE
BNE
MOV
9.3.2
search
: R0 holds a pointer to the first record in the list
: R1 holds the byte we are searching for
: Call this code with a BL
: R0 holds the address of the first record matched
: or a null pointer if no match was found
: R2 is destroyed
R0, #0
R2, [R0]
R1, R2
R0, [R0, #4]
llsearch
PC, LR
;
;
;
;
;
;
null pointer?
load the byte value from this record
compare with the looked-for value
if not found, follow the link to the
next record and then keep looking
return with pointer in R0
R2, [R0], #1
R3, [R1], #1
R2, #0
R3, #0
return
R2, R3
strcmp
;
;
;
;
;
;
;
R0, R2, R3
PC, LR
A9-7
This code uses an unsigned comparison with 1 to test for a null character, rather than the normal comparison
with 0.
The corresponding ARM code is:
strcmp
LDRB
LDRB
CMP
CMPCS
BEQ
SUB
MOV
R2,[R0],#1
R3,[R1],#1
R2,#1
R2,R3
strcmp
R0,R2,R3
PC,LR
The change in the way that null characters are detected allows the condition tests to be combined:
If R2 == 0, the CMP instruction sets Z = 0, C = 0. Neither the CMPCS instruction nor the BEQ
instruction is executed, and the loop terminates.
If R2 != 0 and R3 == 0, the CMP instruction sets C = 1, then the CMPCS instruction is executed and
sets Z = 0. So, the BEQ instruction is not executed and the loop terminates.
If R2 != 0 and R3 != 0, the CMP instruction sets C = 1, then the CMPCS instruction is executed and
sets Z according to whether R2 == R3. So, the BEQ instruction is executed if R2 == R3 and the loop
terminates if R2 != R3.
Much faster string comparison routines are possible by loading one word of each string at a time and
comparing all four bytes.
A9-8
9.3.3
Long branch
A Load instruction can be used to generate a branch to anywhere in the 4GB address space. By manually
setting the value of the link register (R14), a subroutine call can be made to anywhere in the address space.
; Long branch (and link)
ADD
LR, PC, #4
LDR
DCD
return_here
;
;
;
;
;
;
This code uses the location after the load to hold the address of the function to call. In practice, this location
can be anywhere as long as it is within 4KB of the load instruction. Notice also that this code is
position-independent except for the address of the function to call. Full position-independence can be
achieved by storing the offset of the branch target after the load, and using an ADD instruction to add it to
the PC.
9.3.4
Multi-way branches
The following code improves on the multi-way branch code shown above by using a table of addresses of
functions to call:
; Multi-way branch
; On entry: R0 holds the branch index
CMP
R0, #maxindex
LDRLO
B
DCD
DCD
DCD
DCD
....
IndexOutOfRange
Handler0
Handler1
Handler2
Handler3
;
;
;
;
;
;
;
;
;
A9-9
9.4
9.4.1
loop
LDMIA
STMIA
CMP
BLO
function
start of the source block
start of the destination block
end of the source block
R12!, (R0-R11}
R13!, {R0-R11}
R12, R14
loop
;
;
;
;
load 48 bytes
store 48 bytes
reached the end yet?
branch to the top of the loop
The source and destination must be word-aligned, and if the object to be copied is not a multiple of 48 bytes
long, extra bytes are copied to bring the total to the next multiple of 48 bytes. A more sophisticated routine
is needed if this extra copying is to be avoided.
9.4.2
....
Insert the function body here
....
LDMFD
Notice that this code restores all saved registers, updates the stack pointer, and returns the caller (by loading
the PC value) in a single instruction. This allows very efficient conditional return for exceptional cases from
a procedure (by checking the condition with a compare instruction and then conditionally executing the
Load Multiple).
A9-10
9.5
Semaphore instructions
This code controls the entry and exit from a critical section of code. The semaphore instruction (SWP) does
not provide a compare and conditional write facility, so this must be done explicitly. The following code
achieves this by using a semaphore value to indicate that the lock is being inspected.
The code below causes the calling process to busy-wait until the lock is free. To ensure progress, three OS
calls need to be made (one before each loop branch) to sleep the process if the lock cannot be accessed.
;
;
;
;
;
;
spinin
spinout
MVN
SWP
CMN
....
Insert
....
BEQ
CMP
STRNE
....
Insert
....
BNE
STR
.....
Insert
.....
SWP
CMN
....
Insert
....
BEQ
CMP
BNE
MOV
STR
R2, #0
R3, R2, [R0]
R3, #1
;
;
;
;
;
A9-11
9.6
9.6.1
sp!, {r0-r3,r12,lr}
r0, spsr
TST
r0, #0x20
LDRNEH
BICNE
;
;
;
;
;
;
;
;
;
;
;
;
LDREQ
r0, [lr, #-4]
BICEQ
r0, r0, #0xff000000
CMP
r0, #MaxSWI
LDRLS
pc, [pc, r0, LSL #2]
B
SWIOutOfRange
switable
DCD
do_swi_0
DCD
do_swi_1
:
:
do_swi_0
.....
Insert code to handle SWI 0 here
.....
LDMFD
sp!, {r0-r3,r12,pc}^ ; Restore the registers and return.
do_swi_1
:
A9-12
9.6.2
where:
R8
Points to the base address of the input/output device that data is read from.
IOData
Is the offset from the base address to the 32-bit data register that is read. Reading this
register disables the interrupt.
R9
R10
Of course, byte transfers can be made by replacing the load and store instructions with Load and Store byte
instructions, and changing the offset in the store instruction from 4 to 1. Transfers from memory to an
input/output device are made by swapping the addressing modes between the Load instruction and the Store
instruction.
9.6.3
where:
A9-13
R8
Points to the base address of the input/output device that data is read from.
IOStat
Is the offset from the base address to a register indicating which of two ports caused the
interrupt.
IOPort1Active
Is a bit mask indicating if the first port caused the interrupt (otherwise it is assumed that the
second port caused the interrupt).
IOPort1,IOPort2
Are offsets to the two data registers to be read. Reading a data register disables the interrupt
for that port.
R9
Points to the memory location that data from the first port is being transferred to.
R10
Points to the memory location that data from the second port is being transferred to.
R11,R12
Point to the last address to transfer to (R11 for the first port, R12 for the second).
Again, byte transfers can be made by suitably replacing the load and store instructions. Transfers from
memory to an input/output device are made by swapping the addressing modes between the conditional load
instructions and the conditional store instructions.
A9-14
9.6.4
Interrupt prioritization
This code dispatches up to 32 interrupt sources to their appropriate handler routines. This code is intended
to use the normal interrupt vector, so memory location 0x00000018 must contain an instruction that
branches to the first instruction of this code.
External hardware is used to prioritize the interrupt and present the number of the highest-priority active
interrupt in an input register. Interrupts are re-enabled after 10 instructions (including the branch to this
code).
; first save the critical state
;
SUB
r14, r14, #4
; adjust return address before saving it
STMFD r13!, {r12, r14}
; stack return address and working register
MRS
r12, SPSR
; get the SPSR ...
STMFD r13!, {r12}
; ... and stack that too
;
; now get the priority level of the highest priority active interrupt
MOV
r12, #IntBase
; get interrupt controllers base address
LDR
r12, [r12, #IntLevel]
; get the interrupt level (0 to 31)
;
; now read-modify-write the CPSR to enable interrupts
MRS
r14, CPSR
; read the status register
BIC
r14, r14, #0x80
; clear the I bit (use 0x40 for the F bit)
MSR
CPSR_c, r14
; write it back to re-enable interrupts
; jump to the correct handler
LDR
PC, [PC, r12, LSL #2]
; and jump to the correct handler. PC base
; address points to this instruction + 8
NOP
; pad so the PC indexes this table
;
; table of handler start addresses
;
DCD
Priority0Handler
DCD
Priority1Handler ........
Priority0Handler
STMFD r13!, {r0 - r11}
; save working registers
;
; insert handler code here
;
........
MRS
r12, CPSR
; Read-modify-write the CPSR to disable
ORR
r12, r12, #0x80
; interrupts (use 0x40 instead for FIQs)
MSR
CPSR_c, r12
; Note: Do not use r14 instead of r12. It
; will be corrupted if an interrupt occurs
LDMFD r13!, {r0-r12}
; Recover the working registers and SPSR
MSR
SPSR_cxsf, r12
; Put the SPSR back
LDMFD r13!, {r12, PC}^
; Restore last working register and return
Priority1Handler
........
A9-15
where:
9.6.5
R13
Is assumed to point to a small Full Descending stack. The stack space required is 60 bytes
times the maximum level to which interrupts can possibly be nested.
IntBase
IntLevel
Holds the offset (from IntBase) of the register containing the highest priority active
interrupt.
Context switch
This section gives a very simple example of how to perform context switches between User mode processes,
in order to illustrate some of the instructions used for this purpose. It makes the following assumptions about
the system design:
A9-16
Context switches are performed by an IRQ handler. This handler first performs normal interrupt
processing to identify the source of the interrupt and deal with it. The details of this are
system-specific and are not described here. At the end of normal interrupt processing, the interrupt
handler can choose either to return to the interrupted process, or to switch to another process.
Only User mode context switches are to be supported. If an IRQ is allowed to occur in a privileged
process, the IRQ handler always returns to the interrupted process.
The normal interrupt processing code requires registers R0-R3, R12 and R14_irq to be preserved
around it. It leaves R4-R11 unchanged, and uses R13_irq as a Full Descending stack pointer. (These
assumptions basically mean that it can call subroutines that adhere to the standard ARM Procedure
Calling Standard.)
The normal interrupt processing code does not re-enable interrupts, change SPSR_irq or change to
another processor mode, and FIQ handlers also do not re-enable interrupts. As a result, neither
SPSR_irq nor the banked versions of R13, R14 and the SPSR belonging to the interrupted process
are changed by execution of the normal interrupt processing code.
Each User mode process has an associated Process Control Block (PCB), which stores its register
values while it is not running. The format of a PCB is shown in Figure 9-1.
CPSR
Increasing
addresses
Restart address
R0
R1
R2
R3
R4
R5
R6
R7
R8
R9
R10
R11
R12
R13
R14
R14, R14, #4
R13!, {R0-R3, R12, R14}
This is followed by the normal interrupt processing code. If this code decides to return to the interrupted
process, it executes the instruction:
LDMFD
This instruction is the form of LDM described in LDM (3) on page A4-34, and causes:
Registers R0-R3 and R12 to be reloaded with their values on entry to the IRQ handler, which were
stored by the STMFD instruction.
The PC to be reloaded with the R14 value stored by the STMFD instruction, which is 4 less than the
value of R14_irq on entry to the IRQ handler and so is the address of the next instruction to be
executed in the interrupted process (see Interrupt request (IRQ) exception on page A2-19).
The CPSR to be reloaded from SPSR_irq, which was set to the CPSR of the interrupted process on
interrupt entry and has remained unchanged since.
The values of all other registers belonging to the interrupted process were left unchanged by interrupt entry
and by execution of the normal interrupt processing code, so this fully restores the context of the interrupted
process.
A9-17
If the normal interrupt processing code instead switches to another User mode process, it puts pointers to
the PCBs of the old and new processes in R0 and R1 respectively and branches to the following code:
; First store the old processs User mode state to the PCB pointed to by R0.
MRS
R12, SPSR
; Get CPSR of interrupted process
STR
R12, [R0], #8
; Store CPSR to PCB, point R0 at
;
PCB location for R0 value
LDMFD
R13!, {R2, R3}
; Reload R0/R1 of interrupted
; process from stack
STMIA
R0!, {R2, R3}
; Store R0/R1 values to PCB, point
;
R0 at PCB location for R2 value
LDMFD
R13!, {R2, R3, R12, R14} ; Reload remaining stacked values
STR
R14, [R0, #-12]
; Store R14_irq, the interrupted
;
processs restart address
STMIA
R0, {R2-R14}^
; Store user R2-R14 - see Note 1
; Then load the new processs User mode state and return to it.
LDMIA
R1!, {R12, R14}
; Put interrupted processs CPSR
MSR
SPSR_fsxc, R12
;
and restart address in SPSR_irq
;
and R14_irq
LDMIA
R1, {R0-R14}^
; Load user R0-R14 - see Note 2
NOP
; Note: Cannot use banked register
;
immediately after User mode LDM
MOVS
PC, R14
; Return to address in R14_irq,
;
with SPSR_irq -> CPSR transfer
Note
A9-18
1.
This instruction is an example of the form of STM described in STM (2) on page A4-86. It stores the
registers R2, R3, ..., R12, R13_usr, R14_usr to the correct places in the PCB.
2.
This instruction is an example of the form of LDM described in LDM (2) on page A4-32. It loads the
registers R0, R1, ..., R12, R13_usr, R14_usr from the correct places in the PCB.
Chapter A10
Enhanced DSP Extension
This chapter describes the enhanced DSP additions to the ARM programmers model and instruction set,
included in E variants of ARM architecture versions 5 and above. It contains the following sections:
A10-1
10.1
A10-2
10.2
If the correct mathematical result lies within the available range from 231 to +231 1, the result of
the operation is equal to the correct mathematical result.
If the correct mathematical result is greater than +231 1 and so overflows the upper end of the
representable range, the result of the operation is equal to +231 1.
If the correct mathematical result is less than 231 and so overflows the lower end of the representable
range, the result of the operation is equal to 231.
Put another way, the result of a saturated arithmetic operation is the closest representable number to the
correct mathematical result of the operation.
The enhanced DSP instructions support saturated signed 32-bit integer additions and subtractions, by use of
the QADD and QSUB instructions. Variants of these instructions (QDADD and QDSUB) perform a saturated
doubling of one of the operands before the saturated addition or subtraction.
Saturated integer multiplications are not supported, because the product of two values of widths A and B
bits never overflows an (A+B)-bit destination.
A10-3
10.3
A10-4
10.4
The Q flag
The enhanced DSP extension incorporates a mechanism to determine whether saturation or overflow has
occurred in the course of a calculation. Bit[27] of the CPSR is a sticky overflow flag, also known as the Q
flag. This flag is set to 1 if any of the following occurs:
Note
The Q flag is not affected by overflow during any other arithmetic instruction, such as ADD, SUB, or MLA.
The Q flag is sticky in that once it has been set to 1, it is not affected by whether subsequent calculations
saturate and/or overflow. Its intended usage is:
1.
Use an MSR CPSR_f,#0 instruction to clear the Q flag (this also clears the condition code flags).
2.
3.
Use an MRS Rn,CPSR instruction to read the CPSR, then test the value of the Q flag. If it is still 0,
none of the above types of saturation or overflow occurred during step 2. Otherwise, at least one
instance of saturation or overflow occurred.
Each SPSR also has a Q flag into which the CPSR Q flag is copied when an exception occurs as part of the
general CPSR SPSR copy performed on exception entry. Similarly, the exception return instructions
which atomically return to the correct address and perform an SPSR CPSR transfer will copy the SPSR
Q flag back to the CPSR. Between them, these ensure that the value of the Q flag is not changed by an
interrupt or other exception. For more details of this, see Exceptions on page A2-13.
Except as described above, the only instructions that affect or are affected by the Q flags are MSR
instructions which write to the flags byte of the destination PSR, and MRS instructions.
A10-5
10.5
10.5.1
16 16 32 bit signed multiply instructions SMUL<x><y>. These instructions are very similar to
the normal MUL instruction, apart from the fact that their operands are generated as described above.
32 16 32 bit signed multiply instructions SMULW<y>. These instructions produce the upper 32
bits of the 48-bit product.
In all cases, <y> is either the letter B or T, depending on whether the bottom or top half of the second
operand register should be used. Where the first operand is a sign-extended 16-bit value, <x> specifies
whether the bottom or top half of the first operand register should be used in a similar fashion.
A10-6
10.5.2
10.5.3
QADD
QDADD
QSUB
QDSUB
10.5.4
LDRD
STRD
10.5.5
MRRC
A10-7
10.6
10.6.1
LDRD
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U I W 0
16 15
Rn
12 11
Rd
4 3
addr_mode 1 1 0 1 addr_mode
The LDRD instruction loads a pair of ARM registers from two consecutive words of memory. The pair of
registers is restricted to being an even-numbered register and the odd-numbered register that immediately
follows it (for example, R10 and R11).
A greater variety of addressing modes is available than for a 2-register LDM. However, the address of the
first of the two words is required to be doubleword-aligned (that is, the address must be divisible by 8).
Syntax
LDR{<cond>}D
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the even-numbered destination register for the memory word addressed by
<addressing_mode>. The immediately following odd-numbered register is the
destination register for the next memory word. If <Rd> is R14, which would specify R15
as the second destination register, the instruction is UNPREDICTABLE. If <Rd> specifies an
odd-numbered register, the instruction is UNDEFINED.
<addressing_mode>
Is described in Addressing Mode 3 - Miscellaneous Loads and Stores on page A5-34. It
determines the P, U, I, W, Rn, and addr_mode bits of the instruction. The syntax of all forms
of <addressing_mode> includes a base register <Rn>. Some forms also specify that
the instruction modifies the base register value (this is known as base register writeback).
The address generated by <addressing_mode> is the address of the lower of the two
words loaded by the LDRD instruction. The address of the higher word is generated by
adding 4 to this address.
Architecture version
E variants of version 5 and above, excluding ARMv5TExP
A10-8
Exceptions
Data abort
Operation
if ConditionPassed(cond) then
if (Rd is even-numbered) then
if (address[2:0] == 0b000) and (Rd is not R14) then
Rd = Memory[address,4]
R(d+1) = Memory[address+4,4]
else
UNPREDICTABLE
else
UNDEFINED
Notes
Operand restrictions
If <addressing_mode> performs base register writeback and the base register <Rn> is
one of the two destination registers of the instruction, the results are UNPREDICTABLE.
If <addressing_mode> specifies an index register <Rm> and <Rm> is one of the two
destination registers of the instruction, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Time order
The time order of the accesses to the two memory words is not architecturally defined. In
particular, an implementation is allowed to perform the two 32-bit memory accesses in
either order, or to combine them into a single 64-bit memory access.
A10-9
10.6.2
MCRR
31
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 0 0 1 0 0
16 15
Rn
12 11
Rd
cp_num
4 3
opcode
CRm
The MCRR instruction passes the values of ARM registers <Rd> and <Rn> to the coprocessor whose
number is cp_num. If no coprocessors indicate that they can execute the instruction, an undefined
instruction exception is generated.
Syntax
MCRR{<cond>}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<coproc>
Specifies the name of the coprocessor, and causes the corresponding coprocessor number to
be placed in the cp_num field of the instruction. The standard generic coprocessor names
are p0, p1, , p15.
<opcode>
Is a coprocessor-specific opcode.
<Rd>
Is the first ARM register whose value is transferred to the coprocessor. If R15 is specified
for <Rd>, the result is UNPREDICTABLE.
<Rn>
Is the second ARM register whose value is transferred to the coprocessor. If R15 is specified
for <Rn>, the result is UNPREDICTABLE.
<CRm>
Architecture version
E variants of version 5 and above, excluding ARMv5TExP
Exceptions
Undefined instruction
Operation
if ConditionPassed(cond) then
send Rd value to Coprocessor[cp_num]
send Rn value to Coprocessor[cp_num]
A10-10
Usage
MCRR is used to initiate coprocessor operations that depend on values in two ARM registers. An example
for a floating-point coprocessor is an instruction to transfer a double-precision floating-point number held
in two ARM registers to a floating-point register.
Notes
Coprocessor fields
Only instruction bits[31:8] are defined by the ARM architecture. The remaining fields are
recommendations, for compatibility with ARM Development Systems.
Unimplemented coprocessor instructions
Hardware coprocessor support is optional, regardless of the architecture version. An
implementation may choose to implement a subset of the coprocessor instructions, or no
coprocessor instructions at all. Any coprocessor instructions that are not implemented
instead cause an undefined instruction trap.
Order of transfers
If a coprocessor uses these instructions, it will define how each of the values of <Rd> and
<Rn> is used. There is no architectural requirement for the two register transfers to occur
in any particular time order. It is IMPLEMENTATION DEFINED whether Rd is transferred
before Rn, after Rn, or at the same time as Rn.
A10-11
10.6.3
MRRC
31
28 27 26 25 24 23 22 21 20 19
cond
1 1 0 0 0 1 0 1
16 15
Rn
12 11
Rd
cp_num
4 3
opcode
CRm
The MRRC instruction causes the coprocessor whose number is cp_num to transfer values to two ARM
registers <Rd> and <Rn>. If no coprocessors indicate that they can execute the instruction, an undefined
instruction exception is generated.
Syntax
MRRC{<cond>}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<coproc>
Specifies the name of the coprocessor, and causes the corresponding coprocessor number to
be placed in the cp_num field of the instruction. The standard generic coprocessor names
are p0, p1, , p15.
<opcode>
Is a coprocessor-specific opcode.
<Rd>
Is the first destination ARM register. If R15 is specified for <Rd>, the result is
UNPREDICTABLE.
<Rn>
Is the second destination ARM register. If R15 is specified for <Rn>, the result is
UNPREDICTABLE.
<CRm>
Architecture version
E variants of version 5 and above, excluding ARMv5TExP
Exceptions
Undefined instruction
Operation
if ConditionPassed(cond) then
Rd = first value from Coprocessor[cp_num]
Rn = second value from Coprocessor[cp_num]
A10-12
Usage
MRRC is used to initiate coprocessor operations that write values to two ARM registers. An example for a
floating-point coprocessor is an instruction to transfer a double-precision floating-point number held in a
floating-point register to two ARM registers.
Notes
Operand restrictions
Specifying the same register for <Rd> and <Rn> has UNPREDICTABLE results.
Coprocessor fields
Only instruction bits[31:8] are defined by the ARM architecture. The remaining fields are
recommendations, for compatibility with ARM Development Systems.
Unimplemented coprocessor instructions
Hardware coprocessor support is optional, regardless of the architecture version. An
implementation may choose to implement a subset of the coprocessor instructions, or no
coprocessor instructions at all. Any coprocessor instructions that are not implemented
instead cause an undefined instruction trap.
Order of transfers
If a coprocessor uses these instructions, it will define which value is written to <Rd> and
which value to <Rn>. There is no architectural requirement for the two register transfers to
occur in any particular time order. It is IMPLEMENTATION DEFINED whether Rd is transferred
before Rn, after Rn, or at the same time as Rn.
A10-13
10.6.4
PLD
31 30 29 28 27 26 25 24 23 22 21 20 19
1 1 1 1 0 1 I 1 U 1 0 1
16 15 14 13 12 11
Rn
1 1 1 1
addr_mode
The PLD instruction signals the memory system that memory accesses from a specified address are likely
in the near future. The memory system can respond by taking actions which are expected to speed up the
memory accesses when they do occur, such as pre-loading the cache line containing the specified address
into the cache. PLD is a hint instruction, aimed at optimizing memory system performance. It has no
architecturally defined effect, and memory systems that do not support this optimization can ignore it. On
such memory systems, PLD acts as a NOP.
Syntax
PLD
<addressing_mode>
where:
<addressing_mode>
Is described in Addressing Mode 2 - Load and Store Word or Unsigned Byte on page A5-18.
It specifies the I, U, Rn, and addr_mode bits of the instruction. Only addressing modes with
P == 1 and W == 0 are available for this instruction. Pre-indexed and post-indexed
addressing modes have P == 0 or W == 1 and so are not available.
Architecture version
E variants of version 5 and above, excluding ARMv5TExP
Exceptions
None
Operation
/* No change occurs to programmers model state, but where
* appropriate, the memory system is signalled that memory accesses
* to the specified address are likely in the near future.
*/
A10-14
Notes
Condition
Unlike most other ARM instructions, this instruction cannot be executed conditionally.
Writeback
Clearing bit[24] (the P bit) or setting bit[21] (the W bit) has UNPREDICTABLE results.
Data aborts
This instruction never generates a data abort, nor does it signal any sort of memory system
exception detected for the address generated by <addressing_mode> in any other way.
All such memory system exceptions must be ignored by the memory system. Typically, the
memory system does this by treating the PLD instruction as a NOP if any exceptional case
is encountered while handling it.
Alignment
A10-15
10.6.5
QADD
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 0 0
16 15
Rn
12 11
Rd
SBZ
4 3
0 1 0 1
Rm
The QADD instruction performs integer addition, saturating the result to the 32-bit signed integer range 2 31
x 231 1. If saturation actually occurs, the instruction sets the Q flag in the CPSR.
Syntax
QADD{<cond>}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the register that contains the first operand for the saturated addition.
<Rn>
Specifies the register that contains the second operand for the saturated addition.
Architecture version
E variants of version 5 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = SignedSat(Rm + Rn, 32)
if SignedDoesSat(Rm + Rn, 32) then
Q Flag = 1
A10-16
Usage
As well as performing saturated integer and Q31 additions, this instruction can be used in combination with
an SMUL<x><y>, SMULW<y>, or SMULL instruction to produce multiplications of Q15 and Q31 numbers.
Three examples are:
To multiply the Q15 numbers in the bottom halves of R0 and R1 and place the Q31 result in R2, use:
SMULBB
QADD
To multiply the Q31 number in R0 by the Q15 number in the top half of R1 and place the Q31 result
in R2, use:
SMULWT
QADD
R2, R0, R1
R2, R2, R2
R2, R0, R1
R2, R2, R2
To multiply the Q31 numbers in R0 and R1 and place the Q31 result in R2, use:
SMULL
QADD
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, or <Rn> has UNPREDICTABLE results.
Condition flags
A10-17
10.6.6
QDADD
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 1 0 0
16 15
Rn
12 11
Rd
SBZ
4 3
0 1 0 1
Rm
The QDADD instruction doubles its second operand, then adds the result to its first operand. Both the
doubling and the addition have their results saturated to the 32-bit signed integer range 231 x 231 1.
If saturation actually occurs in either operation, the instruction sets the Q flag in the CPSR.
Syntax
QDADD{<cond>}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the register that contains the first operand for the saturated addition.
<Rn>
Specifies the register whose value is to be doubled, saturated, and used as the second
operand for the saturated addition.
Architecture version
E variants of version 5 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = SignedSat(Rm + SignedSat(Rn*2, 32), 32)
if SignedDoesSat(Rm + SignedSat(Rn*2, 32), 32) or
SignedDoesSat(Rn*2, 32) then
Q Flag = 1
A10-18
Usage
The primary use for this instruction is to generate multiply-accumulate operations on Q15 and Q31
numbers, by placing it after an integer multiply instruction. Three examples are:
To multiply the Q15 numbers in the top halves of R4 and R5 and add the product to the Q31 number
in R6, use:
SMULTT
QDADD
To multiply the Q15 number in the bottom half of R2 by the Q31 number in R3 and add the product
to the Q31 number in R7, use:
SMULWB
QDADD
R0, R4, R5
R6, R6, R0
R0, R3, R2
R7, R7, R0
To multiply the Q31 numbers in R2 and R3 and add the product to the Q31 number in R4, use:
SMULL
QDADD
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, or <Rn> has UNPREDICTABLE results.
Condition flags
A10-19
10.6.7
QDSUB
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 1 1 0
16 15
Rn
12 11
Rd
SBZ
4 3
0 1 0 1
Rm
The QDSUB instruction doubles its second operand, then subtracts the result from its first operand. Both the
doubling and the subtraction have their results saturated to the 32-bit signed integer range
231 x 231 1. If saturation actually occurs in either operation, the instruction sets the Q flag in the
CPSR.
Syntax
QDSUB{<cond>}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the register that contains the first operand for the saturated subtraction.
<Rn>
Specifies the register whose value is to be doubled, saturated, and used as the second
operand for the saturated subtraction.
Architecture version
E variants of version 5 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = SignedSat(Rm - SignedSat(Rn*2, 32), 32)
if SignedDoesSat(Rm - SignedSat(Rn*2, 32), 32) or
SignedDoesSat(Rn*2, 32) then
Q Flag = 1
A10-20
Usage
The primary use for this instruction is to generate multiply-subtract operations on Q15 and Q31 numbers,
by placing it after an integer multiply instruction. Three examples are:
To multiply the Q15 numbers in the top half of R4 and the bottom half of R5, and subtract the product
from the Q31 number in R6, use:
SMULTB
QDSUB
To multiply the Q15 number in the bottom half of R2 by the Q31 number in R3 and subtract the
product from the Q31 number in R7, use:
SMULWB
QDSUB
R0, R4, R5
R6, R6, R0
R0, R3, R2
R7, R7, R0
To multiply the Q31 numbers in R2 and R3 and subtract the product from the Q31 number in R4, use:
SMULL
QDSUB
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, or <Rn> has UNPREDICTABLE results.
Condition flags
A10-21
10.6.8
QSUB
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 1 0
16 15
Rn
12 11
Rd
SBZ
4 3
0 1 0 1
Rm
The QSUB instruction performs integer subtraction, saturating the result to the 32-bit signed integer range
231 x 231 1. If saturation actually occurs, the instruction sets the Q flag in the CPSR.
Syntax
QSUB{<cond>}
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the register that contains the first operand for the saturated subtraction.
<Rn>
Specifies the register that contains the second operand for the saturated subtraction.
Architecture version
E variants of version 5 and above
Exceptions
None
Operation
if ConditionPassed(cond) then
Rd = SignedSat(Rm - Rn, 32)
if SignedDoesSat(Rm - Rn, 32) then
Q Flag = 1
Notes
A10-22
Use of R15
Specifying R15 for register <Rd>, <Rm>, or <Rn> has UNPREDICTABLE results.
Condition flags
10.6.9
SMLA<x><y>
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 0 0
16 15
Rd
12 11
Rn
Rs
6 5
1 y x 0
Rm
The SMLA<x><y> instructions (SMLABB, SMLABT, SMLATB and SMLATT) perform a signed
multiply-accumulate operation. The multiply acts on two signed 16-bit quantities, taken from either the
bottom or the top half of their respective source registers. The other halves of these source registers are
ignored. The 32-bit product is added to a 32-bit accumulate value and the result is written to the destination
register.
If overflow occurs during the addition of the accumulate value, the instruction sets the Q flag in the CPSR.
It is not possible for overflow to occur during the multiplication.
Syntax
SMLA<x><y>{<cond>}
where:
<x>
Specifies which half of the source register <Rm> is used as the first multiply operand. If <x>
is B, then x == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rm> is
used. If <x> is T, then x == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rm> is used.
<y>
Specifies which half of the source register <Rs> is used as the second multiply operand. If
<y> is B, then y == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rs>
is used. If <y> is T, then y == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rs> is used.
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the source register whose bottom or top half (selected by <x>) is the first multiply
operand.
<Rs>
Specifies the source register whose bottom or top half (selected by <y>) is the second
multiply operand.
<Rn>
Architecture version
E variants of version 5 and above
A10-23
Exceptions
None
Operation
if ConditionPassed(cond) then
if (x == 0) then
operand1 = SignExtend(Rm[15:0])
else /* x == 1 */
operand1 = SignExtend(Rm[31:16])
if (y == 0) then
operand2 = SignExtend(Rs[15:0])
else /* y == 1 */
operand2 = SignExtend(Rs[31:16])
Rd = (operand1 * operand2) + Rn
if OverflowFrom((operand1 * operand2) + Rn) then
Q Flag = 1
Usage
In addition to its straightforward uses for integer multiply-accumulates, these instructions sometimes
provide a faster alternative to Q15 Q15 + Q31 Q31 multiply-accumulates synthesized from
SMUL<x><y> and QDADD instructions. The main circumstances under which this is possible are:
if it is known that saturation and/or overflow cannot occur during the calculation
if saturation and/or overflow can occur during the calculation but the Q flag is going to be used to
detect this and take remedial action if it does occur.
For example, the following code produces the dot product of the four Q15 numbers in R0 and R1 by the four
Q15 numbers in R2 and R3:
SMULBB
QADD
SMULTT
QDADD
SMULBB
QDADD
SMULTT
QDADD
R4,
R4,
R5,
R4,
R5,
R4,
R5,
R4,
R0,
R4,
R0,
R4,
R1,
R4,
R1,
R4,
R2
R4
R2
R5
R3
R5
R3
R5
A10-24
SMULBB
SMLATT
SMLABB
SMLATT
QADD
R4,
R4,
R4,
R4,
R4,
R0,
R0,
R1,
R1,
R4,
R2
R2, R4
R3, R4
R3, R4
R4
Furthermore, if saturation and/or overflow occurs in this second sequence, it will set the Q flag. This allows
remedial action to be taken, such as scaling down the data values and repeating the calculation.
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, <Rs>, or <Rn> has UNPREDICTABLE
results.
Condition flags
A10-25
10.6.10 SMLAL<x><y>
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 1 0 0
16 15
RdHi
12 11
RdLo
Rs
4 3
1 y x 0
Rm
The SMLAL<x><y> instructions (SMLALBB, SMLALBT, SMLALTB and SMLALTT) perform a signed
multiply-accumulate operation. The multiply acts on two signed 16-bit quantities, taken from either the
bottom or the top half of their respective source registers. The other halves of these source registers are
ignored. The 32-bit product is sign-extended and added to the 64-bit accumulate value held in <RdHi> and
<RdLo>, and the result is written back to <RdHi> and <RdLo>.
Overflow is possible during this instruction, but only as a result of the 64-bit addition. This overflow is not
detected if it occurs. Instead, the result wraps around modulo 264.
Syntax
SMLAL<x><y>{<cond>}
where:
<x>
Specifies which half of the source register <Rm> is used as the first multiply operand. If <x>
is B, then x == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rm> is
used. If <x> is T, then x == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rm> is used.
<y>
Specifies which half of the source register <Rs> is used as the second multiply operand. If
<y> is B, then y == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rs>
is used. If <y> is T, then y == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rs> is used.
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<RdLo>
Supplies the lower 32 bits of the 64-bit accumulate value to be added to the product, and is
the destination register for the lower 32 bits of the 64-bit result.
<RdHi>
Supplies the upper 32 bits of the 64-bit accumulate value to be added to the product, and is
the destination register for the upper 32 bits of the 64-bit result.
<Rm>
Specifies the source register whose bottom or top half (selected by <x>) is the first multiply
operand.
<Rs>
Specifies the source register whose bottom or top half (selected by <y>) is the second
multiply operand.
Architecture version
E variants of version 5 and above
A10-26
Exceptions
None
Operation
if ConditionPassed(cond) then
if (x == 0) then
operand1 = SignExtend(Rm[15:0])
else /* x == 1 */
operand1 = SignExtend(Rm[31:16])
if (y == 0) then
operand2 = SignExtend(Rs[15:0])
else /* y == 1 */
operand2 = SignExtend(Rs[31:16])
RdLo = RdLo + (operand1 * operand2)
RdHi = RdHi + (if (operand1*operand2) < 0 then 0xFFFFFFFF else 0)
+ CarryFrom(RdLo + (operand1 * operand2))
Usage
These instructions allow a long sequence of multiply-accumulates of signed 16-bit integers or Q15 numbers
to be performed, with sufficient guard bits to ensure that the result cannot overflow the 64-bit destination
in practice. It would take more than 233 consecutive multiply-accumulates to cause such overflow.
If the overall calculation does not overflow a signed 32-bit number, then <RdLo> will hold the result of the
calculation.
A simple test to determine whether such a calculation has overflowed <RdLo> is to execute the instruction:
CMP
at the end of the calculation. If the Z flag is set, <RdLo> holds an accurate final result. If the Z flag is clear,
the final result has overflowed a signed 32-bit destination.
Notes
Use of R15
UNPREDICTABLE
Operand restriction If <RdLo> and <RdHi> are the same register, the results are UNPREDICTABLE.
Condition flags
A10-27
10.6.11 SMLAW<y>
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 1 0
16 15
Rd
12 11
Rn
Rs
4 3
1 y 0 0
Rm
The SMLAW<y> instructions (SMLAWB and SMLAWT) perform a signed multiply-accumulate operation. The
multiply acts on a signed 32-bit quantity and a signed 16-bit quantity, with the latter being taken from either
the bottom or the top half of its source register. The other half of the second source register is ignored. The
top 32 bits of the 48-bit product are added to a 32-bit accumulate value and the result is written to the
destination register. The bottom 16 bits of the 48-bit product are ignored. If overflow occurs during the
addition of the accumulate value, the instruction sets the Q flag in the CPSR. No overflow can occur during
the multiplication, because of the use of the top 32 bits of the 48-bit product.
Syntax
SMLAW<y>{<cond>}
where:
<y>
Specifies which half of the source register <Rs> is used as the second multiply operand. If
<y> is B, then y == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rs>
is used. If <y> is T, then y == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rs> is used.
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the source register which contains the 32-bit first multiply operand.
<Rs>
Specifies the source register whose bottom or top half (selected by <y>) is the second
multiply operand.
<Rn>
Architecture version
E variants of version 5 and above
Exceptions
None
A10-28
Operation
if ConditionPassed(cond) then
if (y == 0) then
operand2 = SignExtend(Rs[15:0])
else /* y == 1 */
operand2 = SignExtend(Rs[31:16])
Rd = (Rm * operand2)[47:16] + Rn
/* Signed multiplication */
if OverflowFrom((Rm * operand2)[47:16] + Rn) then
Q Flag = 1
Usage
In addition to its straightforward uses for integer multiply-accumulates, these instructions sometimes
provide a faster alternative to Q31 Q15 + Q31 Q31 multiply-accumulates synthesized from
SMULW<y> and QDADD instructions. The circumstances under which this is possible and the benefits it
provides are very similar to those for the SMLA<x><y> instructions. See Usage on page A10-24 for more
details.
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, <Rs>, or <Rn> has UNPREDICTABLE
results.
Condition flags
A10-29
10.6.12 SMUL<x><y>
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 1 1 0
16 15
Rd
12 11
SBZ
Rs
4 3
1 y x 0
Rm
The SMUL<x><y> instructions (SMULBB, SMULBT, SMULTB, and SMULTT) perform a signed multiply
operation. The multiply acts on two signed 16-bit quantities, taken from either the bottom or the top half of
their respective source registers. The other halves of these source registers are ignored. No overflow is
possible during this instruction.
Syntax
SMUL<x><y>{<cond>}
where:
<x>
Specifies which half of the source register <Rm> is used as the first multiply operand. If <x>
is B, then x == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rm> is
used. If <x> is T, then x == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rm> is used.
<y>
Specifies which half of the source register <Rs> is used as the second multiply operand. If
<y> is B, then y == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rs>
is used. If <y> is T, then y == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rs> is used.
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the source register whose bottom or top half (selected by <x>) is the first multiply
operand.
<Rs>
Specifies the source register whose bottom or top half (selected by <y>) is the second
multiply operand.
Architecture version
E variants of version 5 and above
Exceptions
None
A10-30
Operation
if ConditionPassed(cond) then
if (x == 0) then
operand1 = SignExtend(Rm[15:0])
else /* x == 1 */
operand1 = SignExtend(Rm[31:16])
if (y == 0) then
operand2 = SignExtend(Rs[15:0])
else /* y == 1 */
operand2 = SignExtend(Rs[31:16])
Rd = operand1 * operand2
Usage
In addition to its straightforward uses for integer multiplies, this instruction can be used in combination with
the QADD, QDADD, and QDSUB instructions to perform multiplies, multiply-accumulates, and
multiply-subtracts on Q15 numbers. See the Usage sections on page A10-17, page A10-19, and
page A10-21 for examples.
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, or <Rs> has UNPREDICTABLE results.
Condition flags
A10-31
10.6.13 SMULW<y>
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 1 0 0 1 0
16 15
Rd
12 11
SBZ
Rs
4 3
1 y 1 0
Rm
The SMULW<y> instructions (SMULWB and SMULWT) perform a signed multiply operation. The multiply
acts on a signed 32-bit quantity and a signed 16-bit quantity, with the latter being taken from either the
bottom or the top half of its source register. The other half of the second source register is ignored. The top
32 bits of the 48-bit product are written to the destination register. The bottom 16 bits of the 48-bit product
are ignored.
No overflow is possible during this instruction.
Syntax
SMULW<y>{<cond>}
where:
<y>
Specifies which half of the source register <Rs> is used as the second multiply operand. If
<y> is B, then y == 0 in the instruction encoding and the bottom half (bits[15:0]) of <Rs>
is used. If <y> is T, then y == 1 in the instruction encoding and the top half (bits[31:16]) of
<Rs> is used.
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
<Rm>
Specifies the source register which contains the 32-bit first operand.
<Rs>
Specifies the source register whose bottom or top half (selected by <y>) is the second
operand.
Architecture version
E variants of version 5 and above
Exceptions
None
A10-32
Operation
if ConditionPassed(cond) then
if (y == 0) then
operand2 = SignExtend(Rs[15:0])
else /* y == 1 */
operand2 = SignExtend(Rs[31:16])
Rd = (Rm * operand2)[47:16] /* Signed multiplication */
Usage
In addition to its straightforward uses for integer multiplies, this instruction can be used in combination with
the QADD, QDADD, and QDSUB instructions to perform multiplies, multiply-accumulates and
multiply-subtracts between Q31 and Q15 numbers. See the Usage sections on page A10-17, page A10-19,
and page A10-21 for examples.
Notes
Use of R15
Specifying R15 for register <Rd>, <Rm>, or <Rs> has UNPREDICTABLE results.
Condition flags
A10-33
10.6.14 STRD
31
28 27 26 25 24 23 22 21 20 19
cond
0 0 0 P U I W 0
16 15
Rn
12 11
Rd
4 3
addr_mode 1 1 1 1 addr_mode
The STRD instruction stores a pair of ARM registers to two consecutive words of memory. The pair of
registers is restricted to being an even-numbered register and the odd-numbered register that immediately
follows it (for example, R10 and R11).
A greater variety of addressing modes is available than for a 2-register STM. However, the address of the
first of the two words is required to be doubleword-aligned (that is, the address must be divisible by 8).
Syntax
STR{<cond>}D
<Rd>, <addressing_mode>
where:
<cond>
Is the condition under which the instruction is executed. The conditions are defined in The
condition field on page A3-5. If <cond> is omitted, the AL (always) condition is used.
<Rd>
Specifies the even-numbered register which will be stored to the memory word addressed
by <addressing_mode>. The immediately following odd-numbered register will be
stored to the next memory word. If <Rd> is R14, which would specify R15 as the second
source register, the instruction is UNPREDICTABLE.
If <Rd> specifies an odd-numbered register, the instruction is UNDEFINED.
<addressing_mode>
Is described in Addressing Mode 3 - Miscellaneous Loads and Stores on page A5-34. It
determines the P, U, I, W, Rn, and addr_mode bits of the instruction.
The syntax of all forms of <addressing_mode> includes a base register <Rn>. Some
forms also specify that the instruction modifies the base register value (this is known as base
register writeback).
The address generated by <addressing_mode> is the address of the lower of the two
words stored by the STRD instruction. The address of the higher word is generated by
adding 4 to this address.
Architecture version
E variants of version 5 and above, excluding ARMv5TExP
Exceptions
Data abort
A10-34
Operation
if ConditionPassed(cond) then
if (Rd is even-numbered) then
if (address[2:0] == 0b000) and (Rd is not R14) then
Memory[address,4] = Rd
Memory[address+4,4] = R(d+1)
else
UNPREDICTABLE
else
UNDEFINED
Notes
Operand restrictions
If <addressing_mode> performs base register writeback and the base register <Rn> is
one of the two source registers of the instruction, the results are UNPREDICTABLE.
Data abort
For details of the effects of the instruction if a data abort occurs, see Effects of data-aborted
instructions on page A2-17.
Time order
The time order of the accesses to the two memory words is not architecturally defined. In
particular, an implementation is allowed to perform the two 32-bit memory accesses in
either order, or to combine them into a single 64-bit memory access.
A10-35
A10-36
Part B
Memory and System Architectures
Chapter B1
Introduction to Memory and System
Architectures
This chapter provides a high-level overview of memory and system architectures. It contains the following
sections:
B1-1
1.1
caches
write buffers
Ensuring that the correct accesses to memory-mapped I/O devices occur, and that they occur at the
correct times. (This usually happens automatically in the simplest memory systems, but caches and
other facilities in more complex systems can interfere with it.)
The standard way to perform memory system control in ARM-based systems is to use coprocessor 15
(CP15), which is also known as the System Control coprocessor. Chapter B2 The System Control
Coprocessor provides a top-level overview of this coprocessor.
The rest of Part B (Chapter B3 through Chapter B6) describes standardized ways to perform a variety of
memory system control operations using CP15:
Chapter B3 Memory Management Unit
Describes a sophisticated system to control virtual-to-physical address mapping, access
permissions to memory, and other memory attributes, based on the use of a Memory
Management Unit (MMU).
Chapter B4 Protection Unit
Describes a simpler Protection Unit system which is suitable for many applications which
do not require the full facilities provided by the MMU memory system.
Chapter B5 Caches and Write Buffers
Describes facilities to control caches and write buffers. These are common to the MMU and
Protection Unit systems
Chapter B6 Fast Context Switch Extension
Describes the Fast Context Switch Extension, which facilitates fast switching between up
to 128 processes executing in separate process blocks, each of size up to 32MB.
B1-2
Note
Because of the wide variety of systems based on ARM processors, all functionality described in Part B
might be inappropriate to any given system. Furthermore, some ARM processors have implemented
functions in a different manner to the one described here. Because of this, the datasheet or Technical
Reference Manual for a particular ARM processor is the definitive source for its memory and system control
facilities.
Part B therefore does not attempt to specify absolute requirements on the functionality of the System
Control coprocessor or other memory system components. Instead, it contains guidelines which, if
followed:
mean that the system is more likely to be compatible with existing and future ARM software.
B1-3
1.2
System-level issues
This section lists a number of general and operating-system issues that the system designer needs to address
when using an ARM processor.
1.2.1
ROM memory is normally set as cachable, and should be marked as read only, so the bufferable
attribute is not used and should be 1.
Write buffers
Some ARM implementations incorporate a merging write buffer that subsumes multiple writes to the same
location into a single write to main memory. Furthermore, some write buffers re-order writes, so that writes
are issued to memory in a different order to the order in which they are issued by the processor. Therefore,
I/O locations should not normally be marked as bufferable, to ensure all writes are issued to the I/O device
in the correct order.
For writes to bufferable areas of memory, memory aborts can only be signaled to the processor as a result
of conditions that are detectable at the time the data is placed in the write buffer. Conditions that can only
be detected when the data is later written to main memory (such as a parity error from main memory) must
be handled by other methods (typically by raising an interrupt).
Caches
Frame buffers can be cachable, but frame buffers on writeback cache implementations must be copied back
to memory after the frame buffer has been updated. Frame buffers can be bufferable, but again the write
buffer must be written back to memory after the frame buffer has been updated.
ARM processors do not normally support cache coherence between the ARM and other system bus masters.
Bus snooping is not supported. If memory data is to be shared between multiple bus masters without taking
special software measures to ensure coherency, then the data must be mapped as:
B1-4
Alternatively, using software, you can manage the coherence of data buffers that are read or written by
another bus master by:
cleaning data from writeback caches and write buffers to memory when the processor has written to
the data buffer and before the other bus master reads the buffer
flushing relevant data from caches when the buffer is being read after the other bus master has written
the buffer.
You can use an uncached, unbuffered semaphore to maintain synchronization between multiple bus masters
(see Semaphores on page B1-6).
For implementations with writeback caches, all dirty cache data must be written back before any alterations
are made to the MMU page tables, to ensure that cache line write back can use the page tables to form the
correct physical address for the transfer.
You can index caches using either virtual or physical addresses. Physical pages must only be mapped into
a single virtual page, otherwise the result is UNPREDICTABLE. ARM processors do not normally provide
coherence between multiple virtual copies of a single physical page.
Some ARM implementations support separate instruction and data caches. Coherence between the data and
instruction caches is not necessarily maintained in hardware, so if the instruction stream is written, the
instruction cache and data cache must be made coherent. This can entail:
1.2.2
Interrupts
ARM processors implement fast and normal levels of interrupt. Both interrupts are signaled externally, and
many implementations synchronize interrupts before an exception is raised.
Fast interrupt request (FIQ)
Disables subsequent normal and fast interrupts by setting the I and F bits in the CPSR.
Normal interrupt request (IRQ)
Disables subsequent normal interrupts by setting the I bit in the CPSR.
For more information, see Exceptions on page A2-13.
Canceling interrupts
It is the responsibility of software (the interrupt handler) to ensure that the cause of an interrupt is canceled
(no longer signaled to the processor) before interrupts are re-enabled (by clearing the I and/or F bit in the
CPSR). Interrupts can be canceled with any instruction that might make an external data bus access,
meaning any load or store, a swap, or any coprocessor instruction.
B1-5
Devices that do not instantaneously cancel an interrupt (that is, they do not cancel the interrupt before letting
the access complete) must be probed by software to ensure that interrupts have been canceled before
interrupts are re-enabled. This allows a device connected to a remote I/O bus to operate correctly.
1.2.3
Semaphores
The Swap and Swap Byte instructions have predictable behavior when used in two ways:
Systems with multiple bus masters that use the Swap instructions to implement semaphores to control
interaction between different bus masters.
In this case, the semaphores must be placed in an uncached and unbufferable region of memory. The
Swap instruction then causes a (locked) read-write bus transaction.
This type of semaphore can be externally aborted.
Systems with multiple threads running on a uniprocessor that use the Swap instructions to implement
semaphores to control interaction of the threads.
In this case, the semaphores can be placed in a cached and bufferable region of memory, and a
(locked) read-write bus transaction might or might not occur. The Swap and Swap Byte instructions
are likely to have better performance on such a system than they do on a system with multiple bus
masters (as described above).
This type of semaphore has UNPREDICTABLE behavior if it is externally aborted.
B1-6
Chapter B2
The System Control Coprocessor
This chapter describes coprocessor 15, the System Control coprocessor. It contains the following sections:
B2-1
2.1
B2-2
2.2
Registers
The System Control coprocessor can contain up to 16 primary registers, each of which is 32 bits long. For
some of these, additional bits in the register access instructions are used to identify a specific version of the
register and/or specific types of access to the register, so the number of physical 32-bit registers in CP15
can be more than 16. However, the 4-bit primary register number is used to identify registers in descriptions
of the System Control coprocessor, because it is the primary factor determining the function of the register.
CP15 registers can be read-only, write-only or read/write. The detailed descriptions of the registers specify:
2.2.1
whether a primary register identifies more than one physical register, and if so, how they are
distinguished
any other details that are relevant to the use of the register.
MRC instructions to read the value of a CP15 register into an ARM register.
All CP15 CDP, LDC and STC instructions are UNDEFINED.
31
28 27 26 25 24 23
21 20 19
1 1 1 0
cond
SBZ
16 15
CRn
12 11
Rd
1 1 1 1 opcode2 1
CRm
The MCR and MRC instructions to access the CP15 registers use the generic syntax for those instructions:
MCR{<cond>}
MRC{<cond>}
where:
<cond>
This is the condition under which the instruction is executed. The conditions are
defined in The condition field on page A3-5. If <cond> is omitted, the AL (always)
condition is used.
Bits[23:21]
These bits of the instruction, which are the <opcode1> field in generic MRC and
MCR instructions, are always 0b000 in valid CP15 instructions. If they are not
0b000, the instruction is UNPREDICTABLE.
<Rd>
This is the ARM register involved in the transfer (the source register for MCR and
the destination register for MRC). This register must not be R15, even though MCR
instructions normally allow it to be R15. If R15 is specified for <Rd> in a CP15 MRC
or MCR instruction, the instruction is UNPREDICTABLE.
B2-3
<CRn>
This is the primary CP15 register involved in the transfer (the destination register
for MCR and the source register for MRC). The standard generic coprocessor register
names are c0, c1, ..., c15.
<CRm>
This is an additional coprocessor register name which is used for accesses to some
primary registers to specify additional information about the version of the register
and/or the type of access.
When the description of a primary register does not specify <CRm>, c0 must be
specified. If another register is specified, the instruction is UNPREDICTABLE.
<opcode2>
This is an optional 3-bit number which is used for accesses to some primary
registers to specify additional information about the version of the register and/or
the type of access. If it is omitted, 0 is used.
When the description of a primary register does not specify <opcode2>, it must
be omitted or 0 must be specified. If another value is specified, the instruction is
UNPREDICTABLE.
These MCR and MRC instructions can only be used while the processor is in a privileged mode. If they are
executed while the processor is in User mode, an Undefined Instruction exception occurs.
Note
If access to some System Control coprocessor functionality by User mode programs is required, the usual
solution is that the operating system defines one or more SWIs to supply it. As the precise set of memory
and system facilities available on different processors can vary considerably, it is recommended that all such
SWIs are implemented in an easily replaceable module and that the SWI interface of this module is defined
to be as independent of processor details as possible.
The IMB and IMB_Range SWIs described in Instruction Memory Barriers (IMBs) on page A2-28 are
examples of such SWIs.
B2-4
2.2.2
Reg
Generic use
Specific uses
Details in
ID codes (read-only)
MMU: Reserved
PU: Reserved
Cache lockdown
10
11
Reserved
12
Reserved
13
Process ID
Process ID
14
Reserved
15
IMPLEMENTATION DEFINED
IMPLEMENTATION DEFINED
Implementation documents
B2-5
2.3
Register 0: ID codes
CP15 register 0 contains one or more identification codes for the ARM and system implementation. When
this register is read, the opcode2 field of the MRC instruction selects which identification code is wanted, as
shown in Table 2-2, and the CRm field must be specified as c0 (if it is not, the instruction is
UNPREDICTABLE). Writing to CP15 register 0 is UNPREDICTABLE.
Table 2-2 System Control coprocessor ID registers
opcode2
Register
Details in
0b000
Main ID register
Main ID register
0b001
other
It is recommended that all the ID registers in Table 2-2 are implemented, but only the main ID register
(<opcode2> == 0) is mandatory. Whether or not other ID registers are implemented is IMPLEMENTATION
DEFINED.
If an <opcode2> value corresponding to an unimplemented or reserved ID register is encountered, the
System Control coprocessor returns the value of the main ID register.
ID registers other than the main ID register are defined so that when implemented, their value cannot be
equal to that of the main ID register. Software can therefore determine whether they exist by reading both
the main ID register and the desired register and comparing their values. If the two values are not equal, the
desired register exists.
2.3.1
Main ID register
When CP15 register 0 is read with <opcode2> == 0, an identification code is returned from which, among
other things, the ARM architecture version number can be determined, as well as whether or not the Thumb
instruction set has been implemented.
Note
Only some of the fields in CP15 register 0 are architecturally defined. The rest are IMPLEMENTATION
DEFINED and provide more detailed information about the exact processor variant. Consult individual
datasheets for the precise identification codes used for each processor.
For historical reasons, there are three distinct ways in which the CP15 register 0 ID code might need to be
interpreted. To determine which to use, look at bits[15:12] of the ID code:
if they are 0x7, this indicates that the processor is in the ARM7 family
B2-6
Post-ARM7 processors
If bits[15:12] of the ID code are neither 0x0 nor 0x7, the ID code is interpreted as follows:
31
24 23
Implementor
20 19
Variant
16 15
Architecture
Revision
Bits[3:0]
Bits[15:4]
Contain an IMPLEMENTATION DEFINED representation of the primary part number for the
processor. The top four bits of this number are not allowed to be 0x0 or 0x7.
Bits[19:16]
Contain an architecture code. The following architecture codes are defined (all other values
of the architecture code are reserved by ARM Ltd):
0x1
Architecture 4
0x2
Architecture 4T
0x3
Architecture 5
0x4
Architecture 5T
0x5
Architecture 5TE.
Bits[23:20]
Bits[31:24]
Contain an implementor code. The following codes are defined (all other values of the
architecture code are reserved by ARM Ltd):
0x41
= A (ARM Ltd)
0x44
= D (Digital Equipment Corporation).
0x69
= i (Intel Corporation).
B2-7
24 23 22
Implementor
16 15
Variant
4 3
Revision
Bits[3:0]
Bits[15:4]
Contain an IMPLEMENTATION DEFINED representation of the primary part number for the
processor. The top four bits of this number are 0x7.
Bits[22:16]
Bit[23]
Indicates which of the two possible architectures for an ARM7-based processor is involved:
0
Architecture 3
1
Architecture 4T.
Bits[31:24]
Pre-ARM7 processors
Four processors prior to ARM7 use ID codes in which bits[15:12] are 0x0, and no further processors will
be allocated such ID codes. They are interpreted as a 28-bit processor ID and a 4-bit revision number:
31
Processor ID
Revision
B2-8
0x4156030
ARM3 (Architecture 2)
0x4156060
ARM600 (Architecture 3)
0x4156061
ARM610 (Architecture 3)
0x4156062
2.3.2
29 28
0 0 0
25 24 23
ctype
12 11
Dsize
Isize
ctype
Specifies details of the cache not specified by the S bit and the Dsize and Isize fields. See
Table 2-3 on page B2-9 for details of the encoding. All values not specified in the table are
reserved for future expansion.
S bit
Specifies whether the cache is a unified cache (S == 0), or separate instruction and data
caches (S == 1). If S == 0, the Isize and Dsize fields both describe the unified cache, and
must be identical.
Dsize
Specifies the size, line length and associativity of the data cache, or of the unified cache if
S == 0. See Cache size fields on page B2-10 for details of the encoding.
Isize
Specifies the size, line length and associativity of the instruction cache, or of the unified
cache if S == 0. See Cache size fields on page B2-10 for details of the encoding.
Method
Cache cleaning
Cache lock-down
0b0000
Write-through
Not needed
Not supported
0b0001
Write-back
Not supported
0b0010
Write-back
Register 7 operations
Not supported
0b0110
Write-back
Register 7 operations
Supported, format A
0b0111
Write-back
Register 7 operations
Supported, format B
B2-9
The Read data block method of cleaning write-back caches encoded by ctype == 0b0001 consists of loading
a sequential block of data with size equal to that of the cache, and which is known not to be in the cache
already. It is only suitable for use when the cache organization guarantees that this causes the entire cache
to be reloaded. (For example, direct-mapped caches normally have this property, as do caches using some
types of round-robin replacement.)
Note
This method of cache cleaning must only be used if the Cache Type register has ctype == 0b0001, or if
implementation documentation states that it is a valid method for the implementation.
Register 7: Cache functions on page B5-15 gives details of the register 7 operations used for cleaning other
write-back caches.
For an explanation of cache lockdown and of the formats referred to in Table 2-3, see Register 9: Cache
lockdown on page B5-18.
2.3.3
9 8
0 0 0
size
3 2
assoc
1 0
M len
B2-10
size field
Size if M == 0
Size if M == 1
0b000
0.5KB
0.75KB
0b001
1KB
1.5KB
0b010
2KB
3KB
0b011
4KB
6KB
0b100
8KB
12KB
0b101
16KB
24KB
0b110
32KB
48KB
0b111
64KB
96KB
The line length of the cache is determined by the len field, as shown in Table 2-5.
Table 2-5 Cache line lengths
len field
0b00
2 words (8 bytes)
0b01
0b10
0b11
The associativity of the cache is determined by the assoc field and M bit, as shown in Table 2-6.
Table 2-6 Cache associativity
assoc
field
Associativity if
M == 0
Associativity
if M == 1
0b000
1-way
(direct-mapped)
cache absent
0b001
2-way
3-way
0b010
4-way
6-way
0b011
8-way
12-way
0b100
16-way
24-way
0b101
32-way
48-way
0b110
64-way
96-way
0b111
128-way
192-way
The cache absent encoding overrides all other data in the cache size field.
Alternatively, the following formulae can be used to determine the values LINELEN, ASSOCIATIVITY
and NSETS, defined in Cache size on page B5-4, once the cache absent case (assoc == 0b000, M == 1) has
been checked for and eliminated:
LINELEN
= 1 << (len+3)
MULTIPLIER
ASSOCIATIVITY
= 2 + M
= MULTIPLIER << (assoc-1)
NSETS
/* In bytes */
B2-11
/* In bytes */
Note
Cache length fields with (size + 6 - assoc - len) < 0 are invalid, as they correspond to impossible
combinations of line length, associativity and overall cache size. So the formula for NSETS never involves
a negative shift amount.
B2-12
2.4
Enable/disable bits for the caches, MMUs, and other memory system blocks that are primarily
controlled by other CP15 registers. This allows these memory system blocks to be programmed
correctly before they are enabled.
Various configuration bits for memory system blocks and for the ARM processor itself.
Note
Extra bits of both varieties might be added in the future. Because of this, this register should normally be
updated using read/modify/write techniques, to ensure that currently unallocated bits are not needlessly
modified. Failure to observe this rule might result in code which has unexpected side-effects on future
processors. One exception that may be useful in some circumstances is that 0 can be written to this register
to restore it to its reset state.
31
16 15 14 13 12 11 10 9
UNP/SBZP
6 5
1 0
L4RR V I Z F R S B L D P W C A M
Reading from CP15 register 1 reads the control bits. The <CRm> and <opcode2> fields are ignored when
reading CP15 register 1, and should be zero.
Writing to CP15 register 1 sets the control bits. The <CRm> and <opcode2> fields are not used when
writing CP15 register 1, and should be zero.
When a control bit in CP15 register 1 is not applicable to a particular implementation, it reads as the value
that most closely reflects that implementation, and ignores writes. (Specific examples of this general rule
are documented in the individual bit descriptions below.) Apart from bits that read as 1 according to this
rule, all bits in CP15 register 1 are set to 0 on reset.
M (bit[0])
A (bit[1])
For memory systems which optionally allow the alignment of data memory accesses to be
checked, this bit enables and disables alignment fault checking:
0 = Alignment fault checking disabled
1 = Alignment fault checking enabled.
For other memory systems, this bit ignores writes, and reads as 1 or 0 according to whether
the memory system does or does not check the alignment of data memory accesses.
B2-13
C (bit[2])
If a unified cache is used, this is the enable/disable bit for the unified cache. If separate
caches are used, this is the enable/disable bit for the data cache. In either case:
0 = Cache disabled
1 = Cache enabled.
If the cache is not implemented, this bit reads as 0 and ignores writes. If the cache cannot
be disabled, this bit reads as 1 and ignores writes.
W (bit[3])
P (bit[4])
D (bit[5])
L (bit[6])
In some ARMv3 and earlier implementations, the abort model of the processor could be
configured:
0 = Early Abort Model selected (now obsolete)
1 = Late Abort Model selected (same as Base Updated Abort Model).
For details, see Effects of data-aborted instructions on page A2-17.
On later processors, this bit reads as 1 and ignores writes.
B (bit[7])
On ARM processors which support both little-endian and big-endian memory systems, this
bit is used to configure the ARM processor to the endianness of the memory system:
0 = Configured for little-endian memory system
1 = Configured for big-endian memory system.
For details, see Endianness on page A2-23.
B2-14
On ARM processors that support only little-endian memory systems, this bit reads as 0 and
ignores writes. On ARM processors that support only big-endian memory systems, this bit
reads as 1 and ignores writes.
S (bit[8])
System protection bit (in an MMU-based memory system). The effect of this bit is described
in Access permissions on page B3-16.
R (bit[9])
ROM protection bit (in an MMU-based memory system). The effect of this bit is described
in Access permissions on page B3-16.
F (bit[10])
Z (bit[11])
On ARM processors which support branch prediction, this is the enable/disable bit for
branch prediction:
0 = Branch prediction disabled
1 = Branch prediction enabled.
If branch prediction cannot be disabled, this bit reads as 1 and ignores writes.
On ARM processors that do not support branch prediction, this bit reads as 0 and ignores
writes.
I (bit[12])
If separate caches are used, this is the enable/disable bit for the instruction cache:
0 = Instruction cache disabled
1 = Instruction cache enabled.
If a unified cache is used or the instruction cache is not implemented, this bit reads as 0 and
ignores writes. If the instruction cache cannot be disabled, this bit reads as 1 and ignores
writes.
V (bit[13])
On ARM processors which support the alternative high vectors described in High vectors
on page A2-21, this bit is used to select the location of the exception vector:
0 = Normal exception vectors selected (address range 0x00000000 - 0x0000001C)
1 = High exception vectors selected (address range 0xFFFF0000 - 0xFFFF001C).
On ARM processors that do not support high vectors, this bit reads as 0 and ignores writes.
RR (bit[14])
If the cache allows an alternative replacement strategy to be used which has more easily
predictable worst-case performance, this bit selects it:
0 = Normal replacement strategy (for example, random replacement)
1 = Predictable strategy (for example, round-robin replacement).
If the cache does not allow a choice of replacement strategy this bit should ignore writes,
and read as 0 or 1 according to whether the replacement strategy has a reasonably easily
predictable worst-case performance.
L4 (bit[15])
For some ARM processors that support architecture version 5 or above, this bit controls a
backwards-compatibility feature with previous versions of the architecture.
0 = normal behaviour for the architecture
B2-15
1 = load instructions that load the PC and use bit[0] of the loaded value to determine whether
to enter ARM or Thumb state (that is, to set the new value of the CPSR T bit) instead ignore
bit[0] of the T bit and stay in the current execution state.
The instructions affected by this are:
B2-16
When these bits are read, they return an UNPREDICTABLE value. When they are written, the
value written must either be zero or a value previously read from the same bits.
2.5
Registers 2-15
System Control coprocessor registers other than registers 0 and 1 are allocated to specific areas as follows:
CP15 registers 2-6, 8 and 10 are allocated to the memory protection system. See Chapter B3 Memory
Management Unit and Chapter B4 Protection Unit for details of these registers.
CP15 registers 7 and 9 are allocated to the control of caches and write buffers. See Chapter B5 Caches
and Write Buffers for details of these registers.
CP15 register 13 is allocated to the process ID of the Fast Context Switch Extension. See Chapter B6
Fast Context Switch Extension for details of this register.
CP15 register 15 is reserved for IMPLEMENTATION DEFINED purposes. See the technical reference
manual for the implementation or other implementation-specific documentation for details of the
facilities available through this register.
CP15 registers 11, 12 and 14 are reserved for future expansion. Accessing (reading or writing) any
of these registers is UNPREDICTABLE.
B2-17
B2-18
Chapter B3
Memory Management Unit
This chapter describes the memory system architecture based on a Memory Management Unit (MMU). It
contains the following sections:
B3-1
3.1
Note
If the Fast Context Switch Extension is being used (see Chapter B6 Fast Context Switch
Extension), all references to virtual addresses in this chapter mean the modified virtual
address that it generates.
Memory access permissions
These control whether a program has no access, read-only access or read/write access to the
memory area. When an access is not permitted, a memory abort is signaled to the ARM
processor.
The level of access allowed can also be affected by whether the program is running in User
mode or a privileged mode, and by the use of domains (see Domains on page B3-17).
Cachability and bufferability bits (C and B)
These are described in Cachability and bufferability on page B5-8.
System Control coprocessor registers allow high-level control of this system, such as the location of the
translation tables. They are also used to provide status information about memory aborts to the ARM.
The process of doing a full translation table lookup is known as a translation table walk. It is performed
automatically by hardware, and has a significant execution time cost (at least one main memory access, and
often two). To reduce the average cost of a memory access, the results of translation table walks are cached
in one or more structures known as Translation Lookaside Buffers (TLBs). Usually, there is a TLB for each
memory interface of the ARM implementation:
a system with a single memory interface normally has a single unified TLB
a system with separate instruction and data memory interfaces normally has separate instruction and
data TLBs.
If the system also contains a cache or caches, the number of caches is usually determined in the same way
(see Unified or separate caches on page B5-5). So in cached systems, there is normally one TLB per cache.
B3-2
When translation tables in memory are changed or a different translation table is selected (by writing to
CP15 register 2), previously cached translation table walk results in the TLBs are likely to cease to be valid.
The MMU architecture therefore supplies operations to flush TLBs.
The MMU architecture also allows specific translation table walk results to be locked down in a TLB. This
ensures that accesses to the associated memory areas never cause a translation table walk, and has similar
benefits for real-time code to those of locking down instructions and data in the cache (see Register 9: Cache
lockdown on page B5-18).
B3-3
3.2
The C (cachable) and B (bufferable) bits are used to control the cache and write buffer and to
determine whether the access is cached or uncached, as described in Cachability and bufferability on
page B5-8. (If the system does not contain a cache and/or a write buffer, the relevant bits are ignored.)
2.
The access permission bits and domain are used to determine whether the access is permitted. If the
access is not permitted, the MMU signals a memory abort to the ARM processor. Otherwise, the
access is allowed to proceed.
The sections Access permissions on page B3-16, Domains on page B3-17 and Aborts on page B3-18
describe in more detail how this is done.
3.
For an uncached memory access (including all memory accesses in an uncached system), the physical
address is used as the address for the main memory access.
For a cached memory access, the physical address is used as the address for the line fetch in the event
of a cache miss. If a cache hit occurs, the physical address is ignored.
Access
control
hardware
Access bits,
domain
Translation
table walk
hardware
TLB
Abort
Physical address
(PA)
Main
memory
C, B bits
ARM
Virtual address
(VA)
Cache
and
write buffer
Cache
line fetch
hardware
3.2.1
It is IMPLEMENTATION DEFINED whether caches and write buffers are allowed to be enabled while the
MMU is disabled.
For caches and write buffers which are not allowed to be enabled while the MMU is disabled,
the values of the C and B bits for a memory access are irrelevant.
For caches and write buffers which are allowed to be enabled while the MMU is disabled, a
data access is treated as uncachable and unbufferable (C == 0, B == 0). An instruction fetch is
treated as uncachable (C == 0) in a system with a unified TLB, and as cachable (C == 1) in a
system with a separate instruction TLB.
No memory access permission checks are performed, and no aborts are generated by the MMU.
The physical address for every access is equal to its virtual address (this is known as a flat address
mapping).
Before the MMU is enabled, suitable translation tables must be set up in memory and all relevant CP15
registers must be programmed.
Note
Enabling or disabling the MMU effectively changes the virtual-to-physical address mapping (unless the
translation tables are set up to implement a flat address mapping). It is therefore likely that any caches, for
example, that are enabled at the time will need to be flushed (see Address mapping changes on page B5-10).
In addition, if the physical address of the code that enables or disables the MMU differs from its virtual
address, instruction prefetching can cause complications (see Prefetching and self-modifying code on
page A2-27). It is therefore strongly recommended that code which enables or disables the MMU has
identical virtual and physical addresses.
B3-5
3.3
Translation process
The MMU supports memory accesses based on sections or pages:
Sections
Small pages
Large pages
Sections and large pages are supported to allow mapping of a large region of memory while using only a
single entry in the TLB. Additional access control mechanisms are extended within small pages to 1KB
subpages, and within large pages to 16KB subpages. There are no similar subpages for tiny pages, so access
controls for tiny pages apply to the entire page.
The translation table held in main memory has two levels:
First-level table
Second-level tables
Hold both large and small page translations. One type of second-level table can also
hold tiny page translations.
The MMU translates virtual addresses generated by the CPU into physical addresses to access external
memory, and also derives and checks the access permission. There are four routes by which the address
translation (and therefore permission check) takes place. The route taken depends on whether the address
in question has been marked as a section-mapped access or a page-mapped access. A page-mapped access
can be a large, small, or tiny page access.
However, the translation process always starts out in the same way, as described below, with a first-level
fetch. A section-mapped access only requires a first level fetch, but a page-mapped access also requires a
second-level fetch.
3.3.1
3.3.2
First-level fetch
Bits[31:14] of the Translation Table Base register are concatenated with bits[31:20] of the virtual address
and two zero bits to produce a 32-bit physical address as illustrated in Figure 3-2. This address selects a
four-byte translation table entry which is a first-level descriptor for a section or a pointer to a second-level
page table.
B3-6
31
14 13
Translation base
SBZ
31
20 19
Table index
31
14 13
2 1
Translation base
Table index
00
3.3.3
First-level descriptors
Each entry in the first-level table is a descriptor of how its associated 1MB virtual address range is mapped.
There are the following possibilities, selected by bits[1:0] of the descriptor as shown in Table 3-1:
If bits[1:0] == 0b00, the associated virtual addresses are unmapped, and attempts to access them
generate a translation fault (see Aborts on page B3-18). Software can use bits[31:2] for its own
purposes in such a descriptor, as they are ignored by the hardware. Where appropriate, it is suggested
that bits[31:2] continue to hold valid access permissions for the descriptor.
If bits[1:0] == 0b10, the entry is a section descriptor for its associated virtual addresses. See Section
descriptor and translating section references on page B3-8 for details of how it is interpreted.
If bit[0] == 1, the entry gives the physical address of a coarse second-level table (if bit[1] == 0) or of
a fine second-level table (if bit[1] == 1). Each type of table specifies how the associated 1MB virtual
address range is mapped. Coarse tables are smaller, at 1KB per table (compared with 4KB per table
for fine tables). However, coarse tables can only map large pages and small pages, while fine tables
can map large, small and tiny pages. The two types of table are described in Coarse page table
descriptor on page B3-9 and Fine page table descriptor on page B3-10.
Table 3-1 First-level descriptor format
31
20 19
Fault
Coarse
page table
Section
Fine page
table
12 11 10 9
SBZ
1 0
0 0
IGN
AP
S
B
Z
S
B
Z
SBZ
Domain
Domain
Domain
IMP
0 1
I
M C B 1 0
P
IMP
1 1
B3-7
3.3.4
Bits[3:2]
The cachable and bufferable bits (see Cachability and bufferability on page B5-8).
Bit[4]
Bits[8:5]
The domain field specifies one of the sixteen possible domains for the section controlled by
this descriptor.
Bit[9]
Bits[11:10]
Access permissions. These bits control the access to the section. See Table 3-3 on
page B3-16 for the interpretation of these bits.
Bits[19:12]
Bits[31:20]
The Section Base Address forms the top 12 bits of the physical address.
Note
The access permissions in the first-level descriptor must be checked before the physical address is
generated. The sequence for checking access permissions is given in Access permissions on page B3-16.
Translation
table base
31
SBZ
Virtual
address
Address of
first-level descriptor
14 13
Translation base
31
31
20 19
Table index
14 13
Translation base
Section index
2 1
Table index
00
First-level fetch
31
First-level descriptor
20 19
Physical
address
31
12 11 10 9 8
SBZ
20 19
5 4 3 2 1
I
S
AP B Domain M C B 1 0
P
Z
Section index
3.3.5
Identify the type of descriptor (0b01 marks a coarse page table descriptor).
Bits[4:2]
Bits[8:5]
The domain field specifies one of the sixteen possible domains for all the pages controlled
by this descriptor.
Bit[9]
Bits[31:10]
The Page Table Base Address is a pointer to a coarse second-level page table, giving the
base address for a second-level fetch to be performed. Coarse second-level page tables must
be aligned on a 1KB boundary.
If a coarse page table descriptor is returned from the first-level fetch, a second-level fetch is initiated to
retrieve a second-level descriptor, as shown in Figure 3-4.
Translation
table base
31
14 13
Translation base
SBZ
31
Virtual
address
Address of
first-level descriptor
31
20 19
First-level
table index
14 13
Translation base
12 11
Second-level
table index
2 1 0
First-level
table index
0 0
First-level fetch
10 9 8
31
First-level descriptor
Address of
second-level descriptor
31
5 4
S
B Domain
Z
IMP
10 9
2 1 0
0 1
2 1 0
Second-level
table index
0 0
B3-9
3.3.6
Identify the type of descriptor (0b11 marks a fine page table descriptor).
Bits[4:2]
Bits[8:5]
The domain field specifies one of the sixteen possible domains for all the pages controlled
by this descriptor.
Bit[11:9]
Bits[31:12]
The Page Table Base Address is a pointer to a fine second-level page table, giving the base
address for a second-level fetch to be performed. Fine second-level page tables must be
aligned on a 4KB boundary.
If a fine page table descriptor is returned from the first-level fetch, a second-level fetch is initiated to retrieve
a second-level descriptor, as shown in Figure 3-5.
Translation
table base
31
14 13
Translation base
SBZ
31
Virtual
address
Address of
first-level descriptor
31
20 19
Second-level
table index
14 13
Translation base
10 9
First-level
table index
2 1 0
First-level
table index
0 0
First-level fetch
31
First-level descriptor
Address of
second-level descriptor
12 11
31
SBZ
9 8
5 4
Domain
IMP
12 11
2 1 0
1 1
2 1 0
Second-level
table index
0 0
B3-10
3.3.7
Second-level descriptor
Each entry in a coarse second-level table corresponds to how a 4KB virtual address range is mapped, and
each entry in a fine second-level table corresponds to how a 1KB virtual address range is mapped. The
entries are page descriptors, and can describe a page which is larger than 4KB or 1KB respectively. When
this happens, the descriptor must be repeated enough times in the second-level table to ensure that the same
descriptor is always used for the page, regardless of which virtual address is being accessed within the page.
There are four possibilities for a second-level descriptor, selected by bits[1:0] of the descriptor as shown in
Table 3-2:
If bits[1:0] == 0b00, the associated virtual addresses are unmapped, and attempts to access them
generate a translation fault (see Aborts on page B3-18). Software can use bits[31:2] for its own
purposes in such a descriptor, as they are ignored by the hardware. Where appropriate, it is suggested
that bits[31:2] continue to hold valid access permissions for the descriptor.
If bits[1:0] == 0b01, the entry is a large page descriptor, describing 64KB of virtual addresses. See
Translating large page references on page B3-13 for details.
A large page descriptor must be repeated 64 times in a fine second-level table or 16 times in a coarse
second-level table to ensure that all of its virtual addresses are described.
If bits[1:0] == 0b10, the entry is a small page descriptor, describing 4KB of virtual addresses. See
Translating small page references on page B3-14 for details.
A small page descriptor must be repeated four times in a fine second-level table to ensure that all of
its virtual addresses are described. In a coarse second-level table, only one instance of each small
page descriptor is needed.
If bits[1:0] == 0b11, the entry is a tiny page descriptor, describing 1KB of virtual addresses. See
Translating tiny page references on page B3-15 for details.
Only one instance of each tiny page descriptor is needed in a fine second-level table. Tiny page
descriptors must not appear in coarse second-level tables. If they do, the results are UNPREDICTABLE.
Table 3-2 Second-level descriptor format
31
16 15
Fault
Large page
Small page
Tiny page
12 11 10 9
6 5
IGN
Large table base address
Small page base address
Tiny page base address
1 0
0 0
SBZ
AP
C B 1 1
B3-11
Bits[3:2]
Are the cachable and bufferable bits (see Cachability and bufferability on page B5-8).
Bits[11:4]
Are the access permission bits. These bits control access to the page. See Table 3-3 on
page B3-16 for the interpretation of these bits. Large pages are split into four subpages:
AP0
Encodes the access permissions for the first subpages.
AP1
Encodes the access permissions for the second subpages.
AP2
Encodes the access permissions for the third subpages.
AP3
Encodes the access permissions for the fourth (last) subpages.
Bits[15:12]
Bits[31:16]
Bits[3:2]
Are the cachable and bufferable bits (see Cachability and bufferability on page B5-8).
Bits[11:4]
Are the access permission bits. These bits control access to the page. See Table 3-3 on
page B3-16 for the interpretation of these bits. Small pages are split into four subpages:
AP0
Encodes the access permissions for the first subpages.
AP1
Encodes the access permissions for the second subpages.
AP2
Encodes the access permissions for the third subpages.
AP3
Encodes the access permissions for the fourth (last) subpages.
Bits[31:12]
B3-12
Bits[1:0]
Bits[3:2]
Are the cachable and bufferable bits (see Cachability and bufferability on page B5-8).
Bits[5:4]
Are the access permission bits. See Table 3-3 on page B3-16 for the interpretation of these
bits, which apply to the entire tiny page.
Bits[9:6]
Bits[31:10]
3.3.8
Note
As the upper four bits of the Page Index and low-order four bits of the Second-level Table Index overlap,
each page table entry for a large page must be repeated 16 times (in consecutive memory locations) in a
coarse page table. Similarly, each page table entry for a large page must be repeated 64 times in a fine page
table.
Translation
table base
31
14 13
Translation base
SBZ
31
Virtual
address
Address of
first-level descriptor
31
20 19
First-level
table index
14 13
Page index
2 1 0
First-level
table index
Translation base
12 11
16 15
0 0
First-level fetch
31
First-level descriptor
Address of
second-level descriptor
10 9 8
31
5 4
S
B Domain
Z
IMP
10 9
2 1 0
0 1
2 1 0
Second-level
table index
0 0
Second-level fetch
16 15
31
Second-level descriptor
16 15
31
Physical address
12 11 10 9 8 7 6 5 4 3 2 1 0
SBZ
Page index
B3-13
3.3.9
Note
When a small page appears in a fine second-level table, the upper two bits of the Page Index and the
low-order two bits of the Second-level Table Index overlap. So each page table entry for a small page must
be repeated four times (in consecutive memory locations) in a fine page table.
Translation
table base
31
14 13
Translation base
SBZ
31
Virtual
address
Address of
first-level descriptor
31
20 19
First-level
table index
14 13
Page index
2 1 0
First-level
table index
Translation base
12 11
Second-level
table index
0 0
First-level fetch
31
First-level descriptor
Address of
second-level descriptor
10 9 8
31
5 4
S
B Domain
Z
IMP
10 9
2 1 0
0 1
2 1 0
Second-level
table index
0 0
Second-level fetch
12 11 10 9 8 7 6 5 4 3 2 1 0
31
Second-level descriptor
12 11
31
Physical address
Page index
B3-14
3.3.10
Note
Tiny pages can not appear in a coarse second-level table.
Translation
table base
31
14 13
Translation base
SBZ
31
Virtual
address
Address of
first-level descriptor
31
20 19
Second-level
table index
14 13
Page index
2 1 0
First-level
table index
Translation base
10 9
First-level
table index
0 0
First-level fetch
31
First-level descriptor
Address of
second-level descriptor
12 11
31
SBZ
9 8
5 4
Domain
1 1
2 1
12 11
2 1
IMP
Second-level
table index
0 0
Second-level fetch
10 9
31
Second-level descriptor
31
Physical address
6 5 4 3 2 1 0
SBZ
AP C B 1 1
10 9
Page index
B3-15
3.4
Access permissions
The access permission bits in section and page descriptors control access to the corresponding section or
page. The access permissions are modified by the System (S) and ROM (R) control bits in CP15 register 1.
Table 3-3 describes the meaning of the access permission bits in conjunction with the S and R bits. If an
access is made to an area of memory without the required permission, a Permission Fault is raised (see
Aborts on page B3-18).
Table 3-3 MMU access permissions
B3-16
AP
Privileged
permissions
User
permissions
0b00
No access
No access
0b00
Read only
No access
0b00
Read only
Read only
0b00
UNPREDICTABLE
UNPREDICTABLE
0b01
Read/write
No access
0b10
Read/write
Read only
0b11
Read/write
Read/write
3.5
Domains
A domain is a collection of sections, large pages and small pages. The ARM architecture supports 16
domains. Access to each domain is controlled by a 2-bit field in the Domain Access Control Register. Each
field allows the access to an entire domain to be enabled and disabled very quickly, so that whole memory
areas can be swapped in and out of virtual memory very efficiently. Two kinds of domain access are
supported:
Clients
Are users of domains (execute programs, access data), and are guarded by the access
permissions of the individual sections and pages that make up the domain.
Managers
Control the behavior of the domain (the current sections and pages in the domain, and the
domain access), and are not guarded by the access permissions of individual sections and
pages in the domain.
One program can be a client of some domains, and a manager of some other domains, and have no access
to the remaining domains. This allows very flexible memory protection for programs that access different
memory resources. Table 3-4 illustrates the encoding of the bits in the Domain Access Control Register.
Table 3-4 Domain Access Values
Value
Access types
Description
0b00
No access
0b01
Client
0b10
Reserved
0b11
Manager
Accesses are not checked against the access permission bits in the
section or page descriptor, so a permission fault cannot be generated
B3-17
3.6
Aborts
Mechanisms that can cause the ARM processor to halt execution because of memory access restrictions are:
MMU fault
External abort
Collectively, MMU faults and external aborts are just called aborts. Accesses that cause aborts are said to
be aborted.
If the memory request that is aborted is an instruction fetch, then a Prefetch Abort exception is raised if and
when the processor attempts to execute the instruction corresponding to the illegal access. If the aborted
access is a data access, a Data Abort exception is raised. See Exceptions on page A2-13 for more
information about Prefetch and Data Aborts.
3.6.1
MMU faults
The MMU generates four types of fault:
alignment fault
translation fault
domain fault
permission fault.
The memory system can abort three types of access:
line fetches
the FSR and FAR are updated for an abort arising from an instruction fetch, and if so, what useful
information they contain about the fault. However, an abort arising from an instruction fetch will never
update the FSR and the FAR between the time that an abort arising from a data access updates them and the
time of the corresponding entry into the Data Abort exception vector. In other words, a Data Abort handler
can rely upon its FAR and FSR values not being corrupted by an abort arising from an instruction fetch that
was not acted upon.
Table 3-5 Priority encoding of fault status
Priority
Sources
FS
[3:0]
Domain
[3:0]
FAR
Highest
Terminal Exception
0b0010
Invalid
IMPLEMENTATION
DEFINED
Lowest
Vector Exception
0b0000
Invalid
Valid
Alignment
0b00x1
Invalid
Valid
First level
Second level
0b1100
0b1110
Invalid
Valid
Valid
Valid
Translation
Section
Page
0b0101
0b0111
Invalid
Valid
Valid
Valid
Domain
Section
Page
0b1001
0b1011
Valid
Valid
Valid
Valid
Permission
Section
Page
0b1101
0b1111
Valid
Valid
Valid
Valid
Section
Page
0b0100
0b0110
Valid
Valid
Valid
Valid
External Abort on
Non-linefetch
Section
Page
0b1000
0b1010
Valid
Valid
Valid
Valid
Note
Alignment faults can write either 0b0001 or 0b0011 into FS[3:0].
Invalid values in Domain[3:0] occur because the fault is raised before a valid domain field has been loaded.
Any abort masked by the priority encoding can be regenerated by fixing the primary abort and restarting the
instruction.
The FS[3:0] encoding for Vector Exception breaks from the pattern that FS[0] is zero for all external aborts.
B3-19
Fault-checking sequence
The sequence by which the MMU checks for access faults is slightly different for Sections and Pages. Figure
3-9 illustrates the sequence for both types of access.
Virtual address
Yes
Checking
alignment?
No
No
Misaligned?
Translation
external
abort
Yes
Alignment
fault
External
abort
No
Section
translation
fault
Yes
Section
Descriptor
fault
Section or page?
Page
External
abort
Yes
Translation
external
abort
No
Invalid
descriptor?
Yes
Page
translation
fault
No
Check domain
Section
domain
fault
No
access
Access
type
Check domain
Manager
Access
type
Client
Section
permission
fault
Yes
No
access
Page
domain
fault
Client
Violation?
Violation?
No
Yes
Sub-page
permission
fault
No
Physical address
B3-20
Terminal exception
This indicates that an irrecoverable fault has occurred. The circumstances under which this can happen (if
at all) are IMPLEMENTATION DEFINED.
Vector exception
When the processor is in a 32-bit configuration (PROG32 is active) and in a 26-bit mode (CPSR[4] == 0),
data access (but not instruction fetches) to the normal exception vectors (address 0x0 to 0x1F) cause a Data
Abort, known as a vector exception. It is IMPLEMENTATION DEFINED if vector exceptions are generated when
the MMU is not enabled. For more information, see Vector exceptions on page A8-11.
Alignment fault
If alignment faults are enabled, an alignment fault is generated on any data word access whose address is
not word-aligned (virtual address bits [1:0] != 0b00), or any halfword access that is not halfword-aligned
(virtual address bit[0] != 0). Alignment faults are not generated on any instruction fetch, or on any byte
access.
Note
If the access generates an alignment fault, it is aborted without reference to further permission checks. It is
IMPLEMENTATION DEFINED if alignment exceptions are generated when the MMU is not enabled.
Translation fault
There are two types of translation fault:
Section
This is generated if the first-level descriptor is marked as invalid. This happens if bits[1:0]
of the descriptor are both 0.
Page
Domain fault
There are two types of domain fault:
Section
Page.
In both cases, the first descriptor holds the 4-bit Domain field which selects one of the sixteen 2-bit domains
in the Domain Access Control Register. The two bits of the specified domain are then checked for access
permissions as detailed in Table 3-4 on page B3-17:
In the case of a section, the domain is checked when the first-level descriptor is returned.
In the case of a page, the domain is checked when the second-level descriptor is returned.
If the specified access is marked as No Access in the Domain Access Control Register, either a Section
Domain Fault or Page Domain Fault occurs.
B3-21
Permission fault
There are section permission faults and subpage permission faults.
Permission faults are checked at the same time as domain faults. If the 2-bit domain field returns client (01),
the permission access check is invoked as follows:
Section
If the first-level descriptor defines a section access, the AP bits of the descriptor define
whether or not the access is allowed, according to Table 3-3 on page B3-16. If the access is
not allowed, a section permission fault is generated.
Subpages
If the first-level descriptor defines a page-mapped access, the second-level descriptor can
define a tiny page, a small page or a large page. If the second-level descriptor defines a tiny
page, it contains a single access permission field (AP), which applies to the whole page.
Otherwise, the second-level descriptor contains four access permission fields (AP3, AP2,
AP1, AP0), each corresponding to one quarter of the page.
For small pages, AP3 is selected by the top 1KB of the page, and AP0 is selected by the
bottom 1KB of the page. For large pages, AP3 is selected by the top 16KB of the page, and
AP0 is selected by the bottom 16KB of the page. The selected AP bits are then interpreted
in exactly the same way as for a section, (see Table 3-3 on page B3-16) the only difference
being that the fault generated is a subpage permission fault.
3.6.2
External aborts
In addition to the MMU faults, the ARM architecture defines an external abort pin which can be used to flag
an error on an external memory access. However, not all accesses can be aborted in this way, so this pin
must be used with great care. The following accesses can be externally aborted and restarted safely:
reads
unbuffered writes
B3-22
3.7
CP15 registers
The MMU is controlled with the System Control coprocessor registers 2, 3, 4, 5, 6, 8 and 10, and some bits
of register 1.
3.7.1
A (bit[1])
This bit enables and disables alignment fault checking (see Alignment fault on page B3-21):
0 = Alignment fault checking disabled
1 = Alignment fault checking enabled.
3.7.2
S (bit[8])
This is the system protection bit. The effect of this bit is described in Access permissions on
page B3-16.
R (bit[9])
This is the ROM protection bit. The effect of this bit is described in Access permissions on
page B3-16.
14 13
UNP/SBZP
Reading from CP15 register 2 returns the physical address of the currently active first-level translation table
in bits[31:14] and an UNPREDICTABLE value in bits[13:0]. The CRm and opcode2 fields are ignored when
reading CP15 register 2 and should be zero.
Writing to CP15 register 2 updates the physical address of the currently active first-level translation table
from the value in bits[31:14] of the written value. Bits[13:0] must be written as zero or as a value previously
read from bits[13:0] of this register. The CRm and opcode2 fields are ignored when writing CP15 register 2
and should be zero.
B3-23
3.7.3
D9
D8
D7
D6
D5
D4
D3
4 3
D2
D1
D0
Reading from CP15 register 3 returns the value of the Domain Access Control Register. The CRm and
opcode2 fields are ignored when reading CP15 register 3 and should be zero.
Writing to CP15 register 3 writes the value of the Domain Access Control Register. The CRm and opcode2
fields are ignored when writing CP15 register 3 and should be zero.
The Domain Access Control Register consists of sixteen 2-bit fields (see Domains on page B3-17), each
defining the access permissions for one of the sixteen Domains (D15D0).
3.7.4
Register 4: Reserved
Reading and writing CP15 register 4 is UNPREDICTABLE.
3.7.5
9 8
UNP/SBZP
4 3
Domain
Status
Reading CP15 register 5 returns the value of the Fault Status Register (FSR). The FSR contains the source
of the last data fault. Only the bottom nine bits are returned. The upper 23 bits are UNPREDICTABLE. The
FSR indicates the domain and type of access being attempted when an abort occurred.
Bit[8]
Returns zero.
Bits[7:4]
Specify which of the sixteen domains (D15D0) was being accessed when a fault occurred.
Bits[3:0]
Indicate the type of access being attempted. The encoding of these bits is shown in Table
3-5 on page B3-19.
The FSR is updated for data faults. It is IMPLEMENTATION DEFINED whether the FSR is updated for prefetch
faults (for details, see Fault Address Register (FAR) and Fault Status Register (FSR) on page B3-18). The
CRm and opcode2 fields are ignored when reading CP15 register 5 and should be zero.
Writing CP15 register 5 sets the Fault Status Register to the value of the data written. This is useful for a
debugger to restore the value of the FSR. The upper 24 bits written should be zero or a value previously read
from the FSR. The CRm and opcode2 fields are ignored when writing CP15 register 5 and should be zero.
B3-24
3.7.6
Fault address
Reading CP15 register 6 returns the value of the FAR. The FAR holds the virtual address of the access
which was attempted when a fault occurred. The FAR is updated for data faults. It is IMPLEMENTATION
DEFINED whether the FAR is updated for prefetch faults (for details see Fault Address Register (FAR) and
Fault Status Register (FSR) on page B3-18). The CRm and opcode2 fields are ignored when reading CP15
register 6 and should be zero.
Writing CP15 register 6 sets the Fault Address Register to the value of the data written. This is useful for a
debugger to restore the value of the FAR. The CRm and opcode2 fields are ignored when writing CP15
register 6 and should be zero.
Note
If the Fast Context Switch Extension (FCSE) described in Chapter B6 is being used, then:
3.7.7
When the FAR is updated for a memory fault, the modified virtual address is written to the FAR.
When the FAR is read by an MRC instruction or written by an MCR instruction, its value is being
treated as data and so no address modification is performed by the FCSE.
B3-25
The invalidate single entry operations can be used to improve performance on some implementations when
only a small amount of memory is being remapped. For each remapped memory area (section, small page
or large page), the invalidate single entry operation needs to be performed on a virtual address in the
memory area. The performance improvement comes from not having to subsequently reload TLB entries
relating to memory areas that were not remapped.
Note
The performance improvement for the invalidate single entry operations is not guaranteed. Implementations
are free to invalidate more than the single requested entry, up to and including invalidating the entire TLB.
Caution
When memory is remapped, all TLB entries relating to the old mapping must be invalidated. If this is not
done, it is possible to get into a state where two TLB entries relate to overlapping ranges of virtual addresses.
Any attempt to address the overlapped virtual memory addresses results in UNPREDICTABLE behavior at
best, and might even physically damage the MMU on some implementations.
It is therefore strongly recommended that great care is taken to invalidate the TLB appropriately whenever
memory is remapped.
<opcode2>
<CRm>
Data
Instruction
0b000
0b0111
SBZ
0b001
0b0111
Virtual
address
0b000
0b0101
SBZ
0b001
0b0101
Virtual
address
0b000
0b0110
SBZ
0b001
0b0110
Virtual
address
Note
If the Fast Context Switch Extension (FCSE) described in Chapter B6 is being used, the virtual addresses
passed to CP15 by some of the functions in Table 3-6 are passed as data. This means that no address
modification is performed for them by the FCSE.
B3-26
3.7.8
32-W 31-W
base
32-2W 31-2W
victim
UNP/SBZP
If the implementation has separate instruction and data TLBs, there are two variants of this register, selected
by the <opcode2> field of the MCR or MRC instruction used to access register 10:
<opcode2> == 0
<opcode2> == 1
If the implementation has a unified TLB, only one variant of this register exists, and <opcode2> should
be zero.
<CRm> must always be c0 for MCR and MRC instructions that access register 10.
Writing register 10 has the following effects:
The victim field specifies which TLB entry is replaced by the translation table walk result generated
by the next TLB miss.
The base field constrains the TLB replacement strategy to only use the TLB entries numbered from
(base) to (number of TLB entries)-1, provided the victim field is already in that range.
Any translation table walk results written to TLB entries while P == 1 are protected from being
invalidated by the register 8 invalidate entire TLB operations. Ones written while P == 0 are
invalidated normally by these operations.
Note
If the number of TLB entries is not a power of two, writing a value to either the base or victim fields which
is greater than or equal to the number of TLB entries has UNPREDICTABLE results.
Reading register 10 returns the last values written to the base field and the P bit, and the number of the next
TLB entry to be replaced in the victim field.
B3-27
Ensure that no processor exceptions can occur during the execution of this procedure, by disabling
interrupts, and so on.
2.
If an instruction TLB or unified TLB is being locked down, write the appropriate version of register
10 with base == N, index == N, and P == 0. If appropriate, also turn off facilities like branch
prediction that make instruction prefetching harder to understand.
3.
4.
If an instruction TLB is being locked down, ensure that all TLB entries are loaded which relate to any
instruction that could be prefetched by the rest of the lockdown procedure. (Provided care is taken
about where the lockdown procedure starts, it is normally possible for one TLB entry to cover all of
these, in which case the first instruction prefetch after the TLB is invalidated can do this job.)
If a data TLB is being locked down, ensure that all TLB entries are loaded which relate to any data
accessed by the rest of the lockdown procedure, including any inline literals used by its code. (This
is usually best done by avoiding the use of inline literals in the lockdown procedure and by putting
all other data used by it in an area covered by a single TLB entry, then loading one data item.)
If a unified TLB is being locked down, do both of the above.
5.
6.
If a data TLB or unified TLB is being locked down, loading an item of data from the
area of memory.
If an instruction TLB is being locked down, using the register 7 prefetch instruction
cache line operation defined in Register 7: Cache functions on page B5-15 to cause an
instruction to be prefetched from the area of memory.
Note
If you are using the Fast Context Switch Extension (FCSE) (see Chapter B6), take care in step 5b, because:
If a data TLB or a unified TLB is being locked down, the address used for the load instruction is
subject to modification by the FCSE.
If an instruction TLB is being locked down, the address used for the register 7 operation is being
treated as data and so is not subject to modification by the FCSE.
To minimise the possible confusion caused by this, it is recommended that the lockdown procedure should:
where appropriate, generate modified virtual addresses itself by ORing the appropriate PID value into
the top 7 bits of the virtual addresses it uses.
B3-28
Use register 8 operations to invalidate each single entry that was locked down.
2.
Note
Step 1 is used in order to ensure that P == 1 entries are not left in the TLB. If they were left in the TLB, the
entire TLB invalidation step (step 3) of a subsequent TLB lockdown procedure would not have the desired
effect.
B3-29
B3-30
Chapter B4
Protection Unit
This chapter describes the ARM Protection Unit. It contains the following sections:
B4-1
Protection Unit
4.1
4.1.1
Protection regions
The sizes and starting addresses of the eight protection regions are defined using CP15 register 6. The size
of a region must be a power of two, and can range from 4KB up to 4GB. The starting address of a region
must be a multiple of its size. For example, a 4KB region (size 0x1000) can start at address 0x12345000,
but an 8KB region (size 0x2000) or larger can not.
The cachable bits (C), bufferable bits (B) and Access Permission (AP) bits of the eight protection regions
are defined by CP15 registers 2, 3 and 5 respectively. These behave similarly to the corresponding bits in
the MMU memory system architecture, except that the interpretation of the AP bits is not modified by the
System (S) and ROM (R) bits in CP15 register 1. (These bits are therefore not normally implemented in
Protection Unit systems.)
Protection regions can legitimately overlap each other. If an address lies within more than one protection
region, the attributes of the highest-numbered protection region apply to it. For more details, see
Overlapping regions on page B4-5.
Some implementations (typically those with separate instruction and data caches) provide two separate sets
of eight protection regions, with one set being used for instruction fetches and the other set for data accesses.
Note
It is possible to program the instruction and data protection regions differently in these implementations, but
some care needs to be taken. In particular, most ARM and Thumb code areas include inline literals, which
are constant addresses and other data items held in the same area as the code itself. Inline literals are
automatically generated by compilers, and can also appear in assembler code. (For ARM Development
Systems, they are typically generated by the use of DCD, DCB and related assembler directives, or by the use
of the construction LDR Rn,=expression together with an LTORG directive.) Inline literals are
typically accessed by LDR instructions with base register R15. Such instructions generate a data access to
the code area, so it does not normally make sense to program an instruction protection region without
programming a corresponding data protection region to allow the code to access its inline literals.
B4-2
Protection Unit
4.1.2
If the address does not lie in any protection region, the memory access is aborted.
If the address lies in one or more protection regions, the access is controlled by the highest-numbered
of those regions. The C, B and AP bits associated with that region are used by the access as follows:
1.
2.
The C (cachable) and B (bufferable) bits are used to control the cache and write buffer and to
determine whether the access is cached or uncached, as described in Cachability and
bufferability on page B5-8. (If the system does not contain a cache and/or a write buffer, the
relevant bits are ignored.)
The AP (access permission) bits are used to determine whether the access is permitted. If the
access is not permitted, the Protection Unit signals a memory abort to the ARM processor.
Otherwise, the access is allowed to proceed.
Register 5: Access permission bits on page B4-7 and Exceptions on page A2-13 describe this
in more detail.
Figure 4-1 illustrates the memory access sequence for a cached system:
Register 5
Selected region
Registers 2, 3
AP bits
C, B bits
Priority encoder
Access
control
hardware
Region address
comparators
Abort
Cache
and
write buffer
ARM
Cache
line fetch
hardware
Main
memory
Virtual/physical address
B4-3
Protection Unit
4.1.3
B4-4
Protection Unit
4.2
Overlapping regions
The Protection Unit can be programmed with two or more overlapping regions. When overlapping regions
are programmed, a fixed priority scheme is applied to determine the region whose attributes are applied to
the memory access.
Attributes for region 7 take highest priority and those for region 0 take lowest priority. For example:
Data region 2 is programmed to be 4KB in size, starting from address 0x3000 with AP == 0b10
(Privileged mode full access, User mode read only).
Data region 1 is programmed to be 16KB in size, starting from address 0x0 with AP == 0b01
(Privileged mode access only).
When the processor performs a data load from address 0x3010 while in User mode, the address falls into
both region 1 and region 2, as shown in Figure 4-2. Because there is a clash, the attributes associated with
region 2 are applied. In this case, the load would not abort.
0x4000
Region 2
0x3010
0x3000
Region 1
0x0
4.2.1
Background regions
Overlapping regions increase the flexibility of how the eight regions can be mapped onto physical memory
devices in the system. The overlapping properties can also be used to specify a background region. For
example, there might be a number of physical memory areas sparsely distributed across the 4GB address
space. If a programming error occurs therefore, it might be possible for the processor to issue an address
which does not fall into any defined region.
If the address issued by the processor falls outside of any of the defined regions, the Protection Unit is
hard-wired to abort the access. This behavior can be overridden by programming region 0 to be a 4GB
background region. In this way, if the address does not fall into any of the other seven regions, the access is
controlled by the attributes the user has specified for region 0.
B4-5
Protection Unit
4.3
CP15 registers
The Protection Unit is controlled with the System Control coprocessor registers 2, 3, 5, and 6, and one or
two bits of register 1.
4.3.1
4.3.2
UNP/SBZP
4 3
C7 C6 C5 C4 C3 C2 C1 C0
Reading from CP15 register 2 returns the cachable (C) bits for the eight protection regions in bits[7:0], with
bit[n] corresponding to region n, and an UNPREDICTABLE value in bits[31:8].
Writing to CP15 register 2 updates the cachable (C) bits of the eight protection regions, with the C bit of
region n being set to bit[n] of the value written. Bits[31:8] must be written as zero or as a value previously
read from bits[31:8] of this register.
In each case, the <CRm> field of the MRC or MCR instruction is ignored and must be c0. If the
implementation only has one set of eight protection regions, the <opcode2> field should be zero. If it has
separate sets of protection regions for instruction and data accesses, <opcode2> must be specified as 0 to
select the data protection regions and 1 to select the instruction protection regions.
For details of how the C bit affects cache and write buffer behavior, see Cachability and bufferability on
page B5-8.
4.3.3
UNP/SBZP
4 3
B7 B6 B5 B4 B3 B2 B1 B0
Reading from CP15 register 3 returns the bufferable (B) bits for the eight protection regions in bits[7:0],
with bit[n] corresponding to region n, and an UNPREDICTABLE value in bits[31:8].
B4-6
Protection Unit
Writing to CP15 register 3 updates the bufferable (B) bits of the eight regions, with the B bit of region n
being set to bit[n] of the value written. Bits[31:8] must be written as zero or as a value previously read from
bits[31:8] of this register.
In each case, the <CRm> and <opcode2> fields of the MRC or MCR instruction are ignored and must be c0
and zero respectively.
For details of how the B bit affects cache and write buffer behavior, see Cachability and bufferability on
page B5-8.
4.3.4
4.3.5
16 15 14 13 12 11 10 9
UNP/SBZP
6 5
1 0
Reading from CP15 register 3 returns the AP bits for the eight protection regions in bits[15:0], with
bits[2n+1:2n] corresponding to region n, and an UNPREDICTABLE value in bits[31:16].
Writing to CP15 register 3 updates the AP bits of the eight regions, with the AP bits of region n being set to
bits[2n+1:2n] of the value written. Bits[31:16] must be written as zero or as a value previously read from
bits[31:16] of this register.
In each case, the <CRm> field of the MRC or MCR instruction is ignored and must be c0. If the
implementation only has one set of eight protection regions, the <opcode2> field should be zero. If it has
separate sets of protection regions for instruction and data accesses, <opcode2> must be specified as 0 to
select the data protection regions and 1 to select the instruction protection regions.
The interpretation of each set of AP bits is as shown in Table 4-1 on page B4-7. If the requested type of
access is not permitted, an abort is signaled to the ARM processor.
Table 4-1 Protection Unit access permissions
AP
Privileged
permissions
User
permissions
0b00
No access
No access
0b01
Read/write
No access
0b10
Read/write
Read only
0b11
Read/write
Read/write
B4-7
Protection Unit
4.3.6
12 11
Base address
UNP/SBZP
Size
Reading from CP15 register 6 returns the current base address, size and enabled/disabled status of a
protection region, in the format shown in the above diagram. The value read for bits[11:6] is
UNPREDICTABLE.
Writing to CP15 register 6 sets the base address, size and enabled/disabled status of a protection region, in
the format shown in the above diagram. The value written to bits[11:6] must either be zero or a value
previously read from bits[11:6] of CP15 register 6.
There is one version of register 6 for each protection region in the Protection Unit. The version used (and
therefore the protection region affected) is selected by the <CRm> and <opcode2> fields of the MCR or
MRC instruction used to access the register:
<CRm> is used to select the number of the protection region, by specifying c0 to select protection
region 0, c1 to select protection region 1, and so on, through to c7 to select protection region 7.
If the implementation only has one set of eight protection regions, the <opcode2> field should be
zero.
If the implementation has separate sets of protection regions for instruction and data accesses,
<opcode2> must be specified as 0 to select a data protection region and 1 to select an instruction
protection region.
The meaning of the fields in the value read from or written to register 6 is as follows:
The Size field selects the associated protection region's size, which can vary from 4KB to 4GB. The
encoding is shown in Table 4-2 on page B4-9.
The Base address field specifies bits[31:12] of the address of the first byte in the associated protection
region.
The address of this first byte is required to be a multiple of the region size, so its bits[11:0] are always
zero and do not need to be programmed. Also, because of this requirement for the region to be aligned
to a multiple of its size, one or more further bits of the base address may also be constrained to be
zero. These additional constraints are shown in Table 4-2 on page B4-9. If they are broken, the
protection region is misaligned, and UNPREDICTABLE behavior might result.
B4-8
Protection Unit
Area size
0b00000 to 0b01010
UNPREDICTABLE
0b01011
4KB
None
0b01100
8KB
0b01101
16KB
0b01110
32KB
0b01111
64KB
0b10000
128KB
0b10001
256KB
0b10010
512KB
0b10011
1MB
0b10100
2MB
0b10101
4MB
0b10110
8MB
0b10111
16MB
0b11000
32MB
0b11001
64MB
0b11010
128MB
0b11011
256MB
0b11100
512MB
0b11101
1GB
0b11110
2GB
0b11111
4GB
B4-9
Protection Unit
B4-10
Chapter B5
Caches and Write Buffers
This chapter describes cache and write buffer control functions that are common to both the MMU-based
memory system and the Protection Unit-based memory system. It contains the following sections:
B5-1
5.1
memory accesses occurring at times other than when the programmer would normally expect them
there being multiple physical locations where a data item can be held.
This chapter discusses these problems, and describes cache and write buffer control facilities that can be
used to work around them. They are common to the Memory Management Unit system architecture
described in Chapter B3 Memory Management Unit and the Protection Unit system architecture described
in Chapter B4 Protection Unit.
Note
The caches described in this chapter are accessed using the virtual address of the memory access. This
implies that they will need to be invalidated and/or cleaned when the virtual-to-physical address mapping
changes or in certain other circumstances, as described in Memory coherency on page B5-10.
If the Fast Context Switch Extension (FCSE) described in Chapter B6 is being used, all references to virtual
addresses in this chapter mean the modified virtual address that it generates.
B5-2
5.2
Cache organization
The basic unit of storage in a cache is the cache line. A cache line is said to be valid when it contains cached
data or instructions, and invalid when it does not. All cache lines in a cache are invalidated on reset. A cache
line becomes valid when data or instructions are loaded into it from memory.
When a cache line is valid, it contains up-to-date values for a block of consecutive main memory locations.
The length of this block (and therefore the length of the cache line) is always a power of two, and is typically
16 bytes (4 words) or 32 bytes (8 words). If the cache line length is 2L bytes, the block of main memory
locations is always 2L-byte aligned. Such blocks of main memory locations are called memory cache lines
or (loosely) just cache lines.
Because of this alignment requirement, virtual address bits[31:L] are identical for all bytes in a cache line.
A cache hit occurs when bits[31:L] of the virtual address supplied by the ARM processor match the same
bits of the virtual address associated with a valid cache line.
To simplify and speed up the process of determining whether a cache hit occurs, a cache is usually divided
into a number of cache sets. The number of cache sets is always a power of two. If the cache line length is
2L bytes and there are 2S cache sets, bits[L+S-1:L] of the virtual address supplied by the ARM processor
are used to select a cache set. Only the cache lines in that set are allowed to hold the data or instructions at
the address.
The remaining bits of the virtual address (bits[31:L+S]) are known as its tag bits. A cache hit occurs if the
tag bits of the virtual address supplied by the ARM processor match the tag bits associated with a valid line
in the selected cache set.
Figure 5-1 illustrates how the virtual address is used to look up data or instructions in the cache.
31
Virtual address
L+S
L+S-1
tag
L L-1
set
0
pos
Select one of 2S
cache sets
if not found
Cache miss
Get data from
main memory
Cache hit
Return data at position pos
in cache line
B5-3
5.2.1
Set-associativity
The set-associativity of a cache is the number of cache lines in each of its cache sets. It can be any number
1, and is not restricted to being a power of two.
Low set-associativity generally simplifies cache look-up. However, if the number of frequently-used
memory cache lines that use a particular cache set exceeds the set-associativity, main memory activity goes
up and performance drops. This is known as cache contention, and becomes more likely as the set
associativity is decreased.
The two extreme cases are fully associative caches and direct-mapped caches:
A fully associative cache has just one cache set, which consists of the entire cache. It is N-way
set-associative, where N is the total number of cache lines in the cache. Any cache look-up in a fully
associative cache needs to check every cache line.
A direct-mapped cache is a one-way set-associative cache. Each cache set consists of a single cache
line, so cache look-up just needs to select and check one cache line. However, cache contention is
particularly likely to occur in direct-mapped caches.
Within each cache set, the cache lines are numbered from 0 to (set associativity)-1. The number associated
with each cache line is known as its index. Some cache operations take a cache line index as a parameter,
to allow a software loop to work systematically through a cache set.
5.2.2
Cache size
Generally, as the size of a cache increases, a higher percentage of memory accesses are cache hits. This
reduces the average time per memory access and so improves performance. However, a large cache
typically uses a significant amount of silicon area and power. Different sizes of cache can therefore be used
in an ARM memory system, depending on the relative importance of performance, silicon area, and power
consumption.
The cache size can be broken down into a product of three factors:
If separate data and instruction caches are used, different values of these parameters can be used for each,
and the resulting cache sizes can be different.
If the System Control coprocessor supports the Cache Type register, it can be used to determine these cache
size parameters (see Cache Type register on page B2-9).
B5-4
5.3
Types of cache
There are many different possible types of cache, which can be distinguished by implementation choices
such as:
how much of the cache is eligible to hold any particular item of data.
A number of these implementation choices are detailed in the subsections below. Also see Cache Type
register on page B2-9 for details of how most of these choices can be determined for implementations which
include a Cache Type register.
Note
A high-performance memory system can contain more than one level of cache, with the first level being
small and very high speed, the next level being bigger and slower, and so on, out to main memory, which
is the largest and slowest component of the memory system. Furthermore, different cache levels can be of
different types.
This chapter only describes the first (or only) level of cache, as does the Cache Type register. If a memory
system implementation provides facilities to control second or higher level caches, details of those facilities
are IMPLEMENTATION DEFINED.
Accordingly, all references to main memory in the rest of this chapter refer to all of the memory system
beyond the first level cache, including any further levels of cache.
5.3.1
B5-5
5.3.2
In a write-through cache, the new data is also immediately written to the main memory location.
(This is usually done though a write buffer, to avoid slowing down the processor.)
In a write-back cache, the cache line is marked as dirty, which means that it contains data values
which are more up-to-date than those in main memory. Whenever a dirty cache line is selected to be
re-allocated to another address, the data currently in the cache line is written back to main memory.
Writing back the contents of the cache line in this manner is known as cleaning the cache line.
Another common term for a write-back cache is a copy-back cache.
The main disadvantage of write-through caches is that if the processor speed becomes high enough relative
to that of main memory, it generates data stores faster than they can be processed by the write buffer. The
result is that the processor is slowed down by having to wait for the write buffer to be able to accept more
data.
Because a write-back cache only stores to main memory once when a cache line is re-allocated, even if many
stores have occurred to the cache line, write-back caches normally generate fewer stores to main memory
than write-through caches. This helps to alleviate the problem described above for write-through caches.
However, write-back caches have a number of drawbacks, including:
longer-lasting discrepancies between cache and main memory contents (see Memory coherency on
page B5-10)
a longer worst-case sequence of main memory operations before a data load can be completed, which
can increase the system's worst-case interrupt latency
Some write-back caches allow a choice to be made between write-back and write-through behavior (see
Cachability and bufferability on page B5-8).
5.3.3
B5-6
In a read-allocate cache, the data is simply stored to main memory. Cache lines are only allocated to
memory locations when data is read/loaded, not when it is written/stored.
In a write-allocate cache, a cache line is allocated to the data and the current contents of main
memory are read into it, then the data is written to the cache line. (It can also be written to main
memory, depending on whether the cache is write-through or write-back.)
The main advantages and disadvantages of these techniques are performance-related. Compared with a
read-allocate cache, a write-allocate cache can generate extra main memory read accesses that would not
have otherwise occurred and/or save main memory accesses on subsequent stores because the data is now
in the cache. The balance between these depends mainly on the number and type of the load/store accesses
to the data concerned, and on whether the cache is write-through or write-back.
Whether write-allocate or read-allocate caches are used in an ARM memory system is IMPLEMENTATION
DEFINED.
5.3.4
Replacement strategies
If a cache is not direct-mapped, a cache miss for a memory address requires one of the cache lines in the
cache set associated with the address to be re-allocated. The way in which this cache line is chosen is known
as the replacement strategy of the cache.
Two typical replacement strategies are:
Random replacement
The cache control logic contains a pseudo-random number generator, the output of which is
used to select the cache line to be re-allocated.
Round-robin replacement
The cache control logic contains a counter which is used to select the cache line to be
re-allocated. Each time this is done, the counter is incremented, so that a different choice is
made next time.
Some caches allow a choice of the replacement strategy in use. Typically, one choice is a simple, easily
predictable strategy like round-robin replacement, which allows the worst-case cache performance for a
code sequence to be determined reasonably easily. The main drawback of such strategies is that their
average performance can change abruptly when comparatively minor details of the program change.
For example, suppose a program is accessing data items D1, D2, ..., Dn cyclically and that all of these data
items happen to use the same cache set. With round-robin replacement in an m-way set-associative cache,
the program is liable to get:
B5-7
5.4
A load from a memory location returns the last value stored to the location, with no side-effects.
A store to a memory location has no side-effects other than to change the memory location value.
Two consecutive loads from a memory location both get the same value.
Two consecutive stores to a memory location result in its value becoming the second value stored,
and the first value stored is discarded.
Memory-mapped I/O locations usually lack one or more of these characteristics, and so are unsuitable for
caching.
Also, write buffers and write-back caches rely on it being possible to delay a store to main memory so that
it actually occurs at a later time than the store instruction was executed by the ARM processor. Again, this
might not be valid for memory-mapped I/O locations. A typical example is an ARM interrupt handler which
stores to an I/O device to acknowledge an interrupt it is generating, and then re-enables interrupts (either
explicitly or as a result of the SPSR CPSR transfer performed on return from the interrupt handler).
If the actual store to the I/O device occurs when the ARM store instruction is executed, the I/O device is no
longer requesting an interrupt by the time that interrupts are re-enabled. But if a write buffer or write-back
cache delays the store, the I/O device might still be requesting the interrupt. If so, this results in a spurious
extra call to the interrupt handler.
Because of problems like these, both the Memory Management Unit and the Protection Unit architectures
allow a memory area to be designated as uncachable, unbufferable or both. This is done by using the
memory address to generate two bits (C and B) for each memory access. Details of how the C and B bits
are produced for each architecture can be found in Chapter B3 Memory Management Unit and Chapter B4
Protection Unit.
Table 5-1 shows how the C and B bits are interpreted for write-through caches, write-back caches without
selectable write-through behavior, and write-back caches with selectable write-through behavior.
Table 5-1 Interpretation of Cachable and Bufferable bits
B5-8
Write-through
cache
Write-back only
cache
Write-back/write-through
cache
Uncached/unbuffered
Uncached/unbuffered
Uncached/unbuffered
Uncached/buffered
Uncached/buffered
Uncached/buffered
Cached/unbuffered
UNPREDICTABLE
Write-through cached/buffered
Cached/buffered
Cached/buffered
Write-back cached/buffered
The purpose of making a memory area unbufferable is to prevent stores to it being delayed. However, if the
area is cachable and a write-back cache is in use, stores can be delayed anyway. This means that the obvious
interpretation of C == 1, B == 0 as cached/unbuffered is not useful for write-back caches. It therefore only
has this interpretation in write-through caches. In write-back caches, it instead results in UNPREDICTABLE
behavior or selects write-through caching, as shown in Table 5-1 on page B5-8.
Note
The reason that a memory-mapped I/O location generally needs to be marked as uncachable is
effectively to prevent the memory system hardware from incorrectly optimizing away loads and
stores to the location. If the I/O system is being programmed in a high-level language, this is not
enough. The compiler also needs to be told not to optimize away these loads and stores. In C and
related languages, the way to do this is to use the volatile qualifier in the declaration of the
memory-mapped I/O location.
It can also be desirable to mark a memory area as uncachable for performance reasons. This typically
occurs for large arrays which are used frequently, but whose access pattern contains little temporal
or spatial locality. Making such arrays uncachable avoids the cost of loading a whole cache line when
only a single access is typically going to occur. It also means that other data items are evicted from
the cache less frequently, which increases the effectiveness of the cache on the rest of the data.
B5-9
5.5
Memory coherency
When a cache and/or a write buffer is used, the system can hold multiple versions of the value of a memory
location. Possible physical locations for these values are main memory, the write buffer and the cache. If
separate caches are used, either or both of the instruction cache and the data cache can contain a value for
the memory location.
Not all of these physical locations necessarily contain the value most recently written to the memory
location. The memory coherency problem is to ensure that when a memory location is read (either by a data
read or an instruction fetch), the value actually obtained is always the value that was most recently written
to the location.
In the ARM memory system architectures, some aspects of memory system coherency are required to be
provided automatically by the system. Other aspects are dealt with by memory coherency rules, which are
limitations on how programs must behave if memory coherency is to be maintained. The behavior of a
program that breaks a memory coherency rule is UNPREDICTABLE.
The following subsections discuss particular aspects of memory coherency in more detail:
5.5.1
It can be the virtual address of the data in the cache line. This is the more usual choice, because it
allows cache line look-up to proceed in parallel with address translation.
If an implementation is designed to use the virtual address, a change to the virtual-to-physical address
mapping can cause major memory coherency problems, as any data in the remapped address range which
is in the cache ceases to be associated with the correct physical memory location.
Similarly, the data in a write buffer can have virtual or physical addresses associated with it, depending on
whether the address mapping is done when data is placed in the write buffer or when it is stored from the
write buffer to main memory. If a write buffer is designed to use the virtual address, a change to the
virtual-to-physical address mapping can again cause memory coherency problems.
These problems can be avoided by performing an IMPLEMENTATION DEFINED sequence of cache and/or
write buffer operations before a change of virtual-to-physical address mapping. Typically, this sequence
contains one or more of the following:
B5-10
There might also be requirements for the code that performs the change of address mapping and any data it
accesses to be uncachable, unbufferable or both.
5.5.2
An instruction is fetched from an address A1, causing the cache line containing that address to be
loaded into the instruction cache.
2.
A data store occurs to an address A2 in the same cache line as A1, causing an update to one or more
of the data cache, the write buffer and main memory, but not to the instruction cache. (A2 might be
the same address as A1, or a different address in the same cache line. The same considerations apply
in both cases.)
3.
An instruction is executed from the address A2. This could result in either the old contents or the new
contents of the memory location being executed, depending on whether the cache line is still present
in the instruction cache or needs to be reloaded.
This problem can be avoided by performing an IMPLEMENTATION DEFINED sequence of cache control
operations between steps 2 and 3. Typically, this sequence consists of:
invalidating the instruction cache for an implementation with separate caches and a write-through
data cache
cleaning the data cache followed by invalidating the instruction cache for an implementation with
separate caches and a write-back data cache.
Therefore, the memory coherency rule to maintain instruction cache coherency is that: if a data store writes
an instruction to memory, this IMPLEMENTATION DEFINED sequence must be executed before the instruction
is executed. A typical case where this needs to be done is when an executable file is loaded into memory.
After loading the file and before branching to the entry point of the newly loaded code, the
IMPLEMENTATION DEFINED sequence must be executed to ensure that the newly loaded program executes
correctly.
The performance cost of the cache cleaning and invalidating required when this happens can be large, both
as a direct result of executing the cache control operations and indirectly because the instruction cache needs
to be reloaded. This means that programming techniques that involve frequent real-time generation and
execution of small code fragments must be treated with care, as porting them to a new memory system can
require careful redesign and re-optimization to avoid excessive performance loss.
ARM DDI 0100E
B5-11
Note
The sequence required to maintain instruction cache coherency is part of the sequence executed by
an Instruction Memory Barrier, but not necessarily all of it. See Instruction Memory Barriers (IMBs)
on page A2-28 for more details.
If it is known that none of the range of addresses containing newly stored instructions is in the
instruction cache, the memory coherency problem described above cannot occur. However, it is
difficult to be certain of this across all ARM implementations because:
A fetch of any instruction in a cache line causes all of the instructions in that cache line to be
loaded into the instruction cache.
Typically, some instructions are fetched but never executed, so it is possible for an instruction
cache line to have been loaded but not to contain any executed instructions. Also, although
instructions that are fetched but not executed are typically close to instructions that have been
executed, this need not be the case in implementations that use branch prediction or similar
techniques.
As a result, code that uses this technique to avoid the instruction cache coherency problem is not fully
implementation-independent.
5.5.3
B5-12
marking the memory areas involved in the DMA operation as uncachable and/or unbufferable
5.5.4
cleaning and/or invalidating the data cache, at least with respect to the address range involved in the
DMA operation
restrictions on processor accesses to the address range involved in the DMA operation until it is
known that the DMA operation is complete.
Note
This requirement applies to a single processor only. If a system contains multiple ARM processors, all
issues relating to memory coherency between the separate processors are system-dependent.
B5-13
5.6
CP15 registers
Caches and write buffers are controlled with System Control coprocessor registers 7 and 9, and some bits
of register 1.
5.6.1
If a unified cache is used, this is the enable/disable bit for the unified cache. If separate
caches are used, this is the enable/disable bit for the data cache. In either case:
0 = Cache disabled
1 = Cache enabled.
If the cache is not implemented, this bit reads as 0 and ignores writes. If the cache cannot
be disabled, this bit reads as 1 and ignores writes.
W (bit[3])
I (bit[12])
If separate caches are used, this is the enable/disable bit for the instruction cache:
0 = Cache disabled
1 = Cache enabled.
If a unified cache is used or the instruction cache is not implemented, this bit reads as 0 and
ignores writes. If the instruction cache cannot be disabled, this bit reads as 1 and ignores
writes.
RR (bit[14])
If the cache allows an alternative replacement strategy to be used which has a more easily
predictable worst-case performance, this bit selects it:
0 = Normal replacement strategy (for example, random replacement)
1 = Predictable strategy (for example, round-robin replacement).
B5-14
5.6.2
Applies to write-back data caches, and means that if the cache line contains stored
data that has not yet been written out to main memory, it is written to main memory
now.
Invalidate
Means that the cache line (or all the lines in the cache) is marked as invalid, so that
no cache hits occur for that line until it is re-allocated to an address.
For write-back data caches, this does not include cleaning the cache line unless that
is also stated.
Prefetch
Means the memory cache line at the specified virtual address (which must be cache
line aligned) is loaded into the cache.
Stops the ARM from executing further until all data in the write buffer has been
stored to main memory. It can be used instead of unbufferable memory when the
timing of specific main memory stores needs to be controlled (for example, when a
store to an interrupt acknowledge location needs to complete before interrupts are
enabled).
Puts the ARM into a low power state and stops it executing further until an interrupt
occurs.
When an interrupt does occur, the MCR instruction completes and the IRQ or FIQ
handler is entered as normal. The return link in R14_irq or R14_fiq contains the
address of the MCR instruction plus 8, so that the normal instruction used for
interrupt return (SUBS PC,R14,#4) returns to the instruction following the MCR.
Prefetch buffer
Is the value that is written to register 7, which is the value in the register <Rd>
specified in the MCR instruction.
If the data is stated to be a virtual address, it must be cache line aligned. This means
that if the cache line length is 2L bytes, bits[L-1:0] of the address must be zero. This
address is looked up in the cache. If a cache hit occurs, the specified operation
B5-15
occurs on the cache line it identifies. If a cache miss occurs, nothing more is done.
A loop of operations of this type can be used to clean and/or invalidate all cache
lines relating to a specified range of addresses.
Note
If the Fast Context Switch Extension (FCSE) described in Chapter B6 is being used,
the virtual addresses passed to CP15 by some of the functions in Table 5-2 on
page B5-16 are passed as data. This means that no address modification is
performed for them by the FCSE.
If the data is stated to be set/index, it identifies the cache line that the operation is to
be applied to by specifying which cache set it belongs to and what its index is within
the set. A loop of operations of this type can be used to clean and/or invalidate an
entire cache, or all of the non-locked down portion of the cache (see Register 9:
Cache lockdown on page B5-18).
If L, A, and S are the logarithms base 2 of the cache size parameters LINELEN,
ASSOCIATIVITY and NSETS, rounded up to an integer in the case of A, the
format of set/index data is:
31
32-A 31-A
index
L+S L+S-1
SBZ
set
L-1
SBZ
For the definitions of the cache size parameters, see Cache size on page B5-4. If the
implementation includes a Cache Type register, these parameters can be determined
from it (see Cache Type register on page B2-9).
Table 5-2 Cache and similar functions
B5-16
<CRm>
<opcode2>
Function
Data
c0
SBZ
c5
SBZ
c5
Virtual address
c5
Set/index
c5
SBZ
c5
SBZ
c5
IMP
c6
SBZ
c6
Virtual address
<opcode2>
Function
Data
c6
Set/index
c7
SBZ
c7
Virtual address
c7
Set/index
c8
SBZ
c10
Virtual address
c10
Set/index
c10
SBZ
c11
Virtual address
c11
Set/index
c13
Virtual address
c14
Virtual address
c14
Set/index
c15
Virtual address
c15
Set/index
B5-17
5.6.3
There is a delay before the system determines that a cache miss has occurred and starts the main
memory access.
If a write-back cache is being used, there might be a further delay due to the need to store the contents
of the cache line that is being re-allocated.
A whole cache line is loaded from main memory, not just the data requested by the ARM processor.
In real-time applications, this increase in the worst-case access time can be very significant.
Cache lockdown is a feature of some ARM memory systems designed to alleviate this. It allows critical code
and data (such as high-priority interrupt routines and the data they access) to be loaded into the cache in
such a way that the cache lines containing them are not subsequently re-allocated. This ensures that all
subsequent accesses to the code and data concerned are cache hits and therefore complete quickly.
In the description that follows, LINELEN, ASSOCIATIVITY and NSETS are the cache size parameters
described in Cache size on page B5-4.
For lockdown purposes, the cache is divided into lockdown blocks, each of which consists of one line from
each cache set. The lockdown blocks are indexed from 0 to ASSOCIATIVITY-1. The cache lines in a
lockdown block are chosen to have the same index as the lockdown block (see Set-associativity on
page B5-4). So lockdown block 0 consists of the cache line with index 0 from each cache set, etc.
Cache lockdown can be performed with a granularity of a lockdown block. Any number of lockdown blocks
from 1 to ASSOCIATIVITY-1 can be chosen. If N lockdown blocks are locked down, they have indices 0
to N-1, and lockdown blocks N to ASSOCIATIVITY-1 are available for normal cache operation.
Note
You cannot lock down the entire cache. At least one lockdown block must be left for normal cache
operation.
Each lockdown block can hold NSETS memory cache lines, provided each of the memory cache lines is
associated with a different cache set. It is recommended that systems are designed so that each lockdown
block contains a set of NSETS consecutive memory cache lines. This is NSETS LINELEN consecutive
memory locations, starting at a cache line boundary. (Such sets are easily identified and are guaranteed to
consist of one cache line associated with each cache set.)
The System Control coprocessor primary register 9 is used to control cache lockdown. If separate caches
are used, there are two variants of this register, selected by the <opcode2> field of the MCR or MRC
instruction used to access register 9:
<opcode2> == 0
<opcode2> == 1
If a unified cache is used, there is only one variant of this register and <opcode2> should be 0.
<CRm> must always be c0 for MCR and MRC instructions that access register 9.
B5-18
32-W 31-W
index
UNP/SBZ
The next cache miss in each cache set replaces the cache line with the specified index in that cache
set.
The replacement strategy for the cache is constrained so that it can only select cache lines with the
specified index and higher, until the register is written again.
Format B:
31 30
W W-1
UNP/SBZ
index
If L == 1, all cache misses replace the cache line with the specified index in the relevant cache set
until the register is written again.
If L == 0, then:
If the previous value of L was 0 and the previous value of index is smaller than the new value,
the behavior is UNPREDICTABLE.
Otherwise, the replacement strategy for the cache is constrained so that it can only select cache
lines with the specified index and higher, until the register is written again.
B5-19
2.
3.
4.
5.
6.
Ensure that no processor exceptions can occur during the execution of this procedure, by disabling
interrupts, for example. If for some reason this is not possible, all code and data used by any exception
handlers that can get called must be treated as code and data used by this procedure for the purpose
of steps 2 and 3.
If an instruction cache or a unified cache is being locked down, ensure that all the code executed by
this procedure is in an uncachable area of memory.
If a data cache or a unified cache is being locked down, ensure that all data used by the following
code is in an uncachable area of memory, apart from the data which is to be locked down.
Ensure that the data/instructions that are to be locked down are in a cachable area of memory.
Ensure that the data/instructions that are to be locked down are not already in the cache, using cache
clean and/or invalidate instructions as appropriate.
For each of i = 0 to N-1:
a.
Write to register 9 with index == i (for Formats A and B), and L == 1 (for Format B).
b.
For each of the cache lines to be locked down in lockdown block i:
If a data cache or a unified cache is being locked down, use an LDR instruction to load a word
from the memory cache line, which ensures that the memory cache line is loaded into the
cache.
7.
If an instruction cache is being locked down, use the register 7 prefetch instruction cache line
operation (<CRm> == c13, <opcode2> == 1) to fetch the memory cache line into the cache.
Write to register 9 with index == N (for Formats A and B), and L == 0 (for Format B).
Note
If the Fast Context Switch Extension (FCSE) described in Chapter B6 is being used, care needs to be taken
in step 6b. This is because:
If a data cache or a unified cache is being locked down, the address used for the LDR instruction is
subject to modification by the FCSE.
If an instruction cache is being locked down, the address used for the register 7 operation is being
treated as data and so is not subject to modification by the FCSE.
To minimise the possible confusion caused by this, it is recommended that the lockdown procedure should:
where appropriate, generate modified virtual addresses itself by ORing the appropriate PID value into
the top 7 bits of the virtual addresses it uses.
B5-20
B5-21