The ARM Architecture

ARM Ltd
• Founded in November 1990
– Spun out of Acorn Computers

• Designs the ARM range of RISC processor

cores
• Licenses ARM core designs to semiconductor
partners who fabricate and sell to their
customers.
– ARM does not fabricate silicon itself

• Also develop technologies to assist with the

design-in of the ARM architecture
– Software tools, boards, debug hardware,
application software, bus architectures,
peripherals etc
ARM Partnership Model
ARM Powered Products
 Data Sizes and Instruction Sets
• The ARM is a 32-bit architecture.

• When used in relation to the ARM:

– Byte means 8 bits
– Halfword means 16 bits (two bytes)
– Word means 32 bits (four bytes)

• Most ARM’s implement two instruction sets

– 32-bit ARM Instruction Set
– 16-bit Thumb Instruction Set

• Jazelle cores can also execute Java bytecode

 Processor Modes
• The ARM has seven basic operating modes:

– User : unprivileged mode under which most tasks run

– FIQ : entered when a high priority (fast) interrupt is raised

– IRQ : entered when a low priority (normal) interrupt is raised

– Supervisor : entered on reset and when a Software Interrupt

instruction is executed

– Abort : used to handle memory access violations

– Undef : used to handle undefined instructions

– System : privileged mode using the same registers as user mode

 The ARM Register Set
Current Visible Registers
r0
Abort
SVC
Undef
IRQ
FIQ
User Mode
Mode
Mode
Mode
Mode
Mode
r1
r2
r3 Banked out Registers
r4
r5
r6 User FIQ IRQ SVC Undef Abort
r7
r8 r8 r8
r9 r9 r9
r10 r10 r10
r11 r11 r11
r12 r12 r12
r13 (sp) r13 (sp) r13 (sp) r13 (sp) r13 (sp) r13 (sp) r13 (sp)
r14 (lr) r14 (lr) r14 (lr) r14 (lr) r14 (lr) r14 (lr) r14 (lr)
r15 (pc)

cpsr
spsr spsr spsr spsr spsr spsr
 User
Register Organization Summary
FIQ IRQ SVC Undef Abort
r0
r1
User
r2 mode
r3 r0-r7,
r4 r15, User User User User
r5 and mode mode mode mode Thumb state
cpsr r0-r12, r0-r12, r0-r12, r0-r12,
r6
r15, r15, r15, r15,
Low registers
r7 and and and and
r8 r8 cpsr cpsr cpsr cpsr
r9 r9
r10 r10 Thumb state
r11 r11 High registers
r12 r12
r13 (sp) r13 (sp) r13 (sp) r13 (sp) r13 (sp) r13 (sp)
r14 (lr) r14 (lr) r14 (lr) r14 (lr) r14 (lr) r14 (lr)
r15 (pc)

cpsr
spsr spsr spsr spsr spsr

Note: System mode uses the User mode register set

 The Registers
• ARM has 37 registers all of which are 32-bits long.
– 1 dedicated program counter
– 1 dedicated current program status register
– 5 dedicated saved program status registers
– 30 general purpose registers

• The current processor mode governs which of several banks is accessible.

Each mode can access
– a particular set of r0-r12 registers
– a particular r13 (the stack pointer, sp) and r14 (the link register, lr)
– the program counter, r15 (pc)
– the current program status register, cpsr

Privileged modes (except System) can also access

– a particular spsr (saved program status register)
 Program Status Registers
31 28 27 24 23 16 15 8 7 6 5 4 0

NZCVQ J U n d e f i n e d I F T mode
f s x c
• Condition code flags • Interrupt Disable bits.
– N = Negative result from ALU – I = 1: Disables the IRQ.
– Z = Zero result from ALU – F = 1: Disables the FIQ.
– C = ALU operation Carried out
– V = ALU operation oVerflowed • T Bit
– Architecture xT only
• Sticky Overflow flag - Q flag – T = 0: Processor in ARM state
– Architecture 5TE/J only – T = 1: Processor in Thumb state
– Indicates if saturation has occurred
• Mode bits
• J bit – Specify the processor mode
– Architecture 5TEJ only
– J = 1: Processor in Jazelle state
 Program Counter (r15)
• When the processor is executing in ARM state:
– All instructions are 32 bits wide
– All instructions must be word aligned
– Therefore the pc value is stored in bits [31:2] with bits [1:0] undefined (as
instruction cannot be halfword or byte aligned).

• When the processor is executing in Thumb state:

– All instructions are 16 bits wide
– All instructions must be halfword aligned
– Therefore the pc value is stored in bits [31:1] with bit [0] undefined (as
instruction cannot be byte aligned).

• When the processor is executing in Jazelle state:

– All instructions are 8 bits wide
– Processor performs a word access to read 4 instructions at once
 Exception Handling
• When an exception occurs, the ARM:
– Copies CPSR into SPSR_<mode>
– Sets appropriate CPSR bits
0x1C FIQ
• Change to ARM state
0x18 IRQ
• Change to exception mode
0x14 (Reserved)
• Disable interrupts (if appropriate)
0x10 Data Abort
– Stores the return address in LR_<mode>
0x0C Prefetch Abort
– Sets PC to vector address 0x08 Software Interrupt

• To return, exception handler needs to:0x04 Undefined Instruction

– Restore CPSR from SPSR_<mode> 0x00 Reset

– Restore PC from LR_<mode> Vector Table

Vector table can be at
This can only be done in ARM state. 0xFFFF0000 on ARM720T
and on ARM9/10 family
devices
 Development of the
ARM Architecture
Improved
Jazelle
Halfword 4 ARM/Thu 5TE 5TEJ
1 and mb Java bytecode
signed Interworki execution
halfword / ng
SA-110 Saturated ARM9EJ- ARM926EJ-
2 byte
maths
CLZ S S
support SA- ARM7EJ- ARM1026E
System 1110 DSP multiply- S J-S
3 mode accumulate
ARM102
instructions SIMD
Thumb
4T 0E Instructions 6
instructi XScale
Early on set Multi-processing
ARM ARM7TD ARM9TD ARM9E-S
architectu MI V6 Memory
MI
res ARM720T ARM940 ARM966E architecture ARM1136E
T -S (VMSA) J-S
Unaligned data
support
 Conditional Execution and Flags
• ARM instructions can be made to execute conditionally
by postfixing them with the appropriate condition code
field.
– This improves code density and performance by reducing
the number of forward branch instructions.
CMP r3,#0 CMP r3,#0
BEQ skip ADDNE r0,r1,r2
ADD r0,r1,r2
skip

• By default, data processing instructions do not affect

the condition code flags but the flags can be optionally
set by using “S”. CMP does notr1 and
decrement need “S”.
set flags
loop
… if Z flag clear then branch
SUBS r1,r1,#1
BNE loop
 Condition Codes

• The possible
Suffix condition
Description codes Flags
are tested
listed below:
EQ Equal Z=1
• Note ALNE is the default
Not equal and does not
Z=0need to be
specified
CS/HS Unsigned higher or same
C=1
CC/LO Unsigned lower C=0
MI Minus N=1
PL Positive or Zero N=0
VS Overflow V=1
VC No overflow V=0
HI Unsigned higher C=1 & Z=0
LS Unsigned lower or sameC=0 or Z=1
GE Greater or equal N=V
LT Less than N!=V
GT Greater than Z=0 & N=V
LE Less than or equal Z=1 or N=!V
AL Always
 Examples of conditional execution
• Use a sequence of several conditional instructions
if (a==0) func(1);

CMP r0,#0
MOVEQ r0,#1
BLEQ func

• Set the flags, then use various condition codes

if (a==0) x=0;
if (a>0) x=1;
CMP r0,#0
MOVEQ r1,#0
MOVGT r1,#1

• Use conditional compare instructions

if (a==4 || a==10) x=0;
CMP r0,#4
CMPNE r0,#10
MOVEQ r1,#0
 Branch instructions
• Branch : B{<cond>} label
• Branch with Link : BL{<cond>} subroutine_label

31 28 27 25 24 23 0

Cond 1 0 1 L Offset

Link bit 0 = Branch

1 = Branch with link
Condition field

• The processor core shifts the offset field left by 2 positions, sign-
extends it and adds it to the PC
– ± 32 Mbyte range
– How to perform longer branches?
 Data processing Instructions
• Consist of :
– Arithmetic: ADD ADC SUB SBC RSB RSC
– Logical: AND ORR EOR BIC
– Comparisons: CMP CMN TST TEQ
– Data movement: MOV MVN

• These instructions only work on registers, NOT memory.

• Syntax:

<Operation>{<cond>}{S} Rd, Rn, Operand2

• Comparisons set flags only - they do not specify Rd

• Data movement does not specify Rn

• Second operand is sent to the ALU via barrel shifter.

 The Barrel Shifter
LSL : Logical Left Shift ASR: Arithmetic Right Shift

CF Destination 0 Destination CF

Multiplication by a power of 2 Division by a power of 2,

preserving the sign bit
LSR : Logical Shift Right ROR: Rotate Right

...0 Destination CF Destination CF

Division by a power of 2 Bit rotate with wrap around

from LSB to MSB
RRX: Rotate Right Extended

Destination CF

Single bit rotate with wrap around

from CF to MSB
 Using the Barrel Shifter:
The Second Operand
Register, optionally with shift operation
Operand Operand – Shift value can be either be:
1 2 • 5 bit unsigned integer
• Specified in bottom byte of another
register.
– Used for multiplication by constant
Barrel
Shifter
Immediate value
– 8 bit number, with a range of 0-255.
• Rotated right through even number of
positions
– Allows increased range of 32-bit
ALU
constants to be loaded directly into
registers

Result
 Immediate constants (1)
• No ARM instruction can contain a 32 bit immediate constant
– All ARM instructions are fixed as 32 bits long
• The data processing instruction format has 12 bits available for
operand2

11 8 7 0
rot immed_8
Quick Quiz:
x2
Shifter 0xe3a004ff
ROR MOV r0, #???

• 4 bit rotate value (0-15) is multiplied by two to give range 0-30 in steps
of 2
• Rule to remember is “8-bits shifted by an even number of bit positions”.
 Immediate constants (2)
• 31
Examples:
ror #0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0
range 0-0x000000ff step 0x00000001

ror #8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 range 0-0xff000000 step 0x01000000

ror #30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 range 0-0x000003fc step 0x00000004

• The assembler converts immediate values to the rotate form:

– MOV r0,#4096 ; uses 0x40 ror 26
– ADD r1,r2,#0xFF0000 ; uses 0xFF ror 16

• The bitwise complements can also be formed using MVN:

– MOV r0, #0xFFFFFFFF ; assembles to MVN r0,#0

• Values that cannot be generated in this way will cause an error.

 Loading 32 bit constants
• To allow larger constants to be loaded, the assembler offers a
pseudo-instruction:
– LDR rd, =const
• This will either:
– Produce a MOV or MVN instruction to generate the value (if possible).
or
– Generate a LDR instruction with a PC-relative address to read the
constant from a literal pool (Constant data area embedded in the
code).
• For example
– LDR r0,=0xFF => MOV r0,#0xFF
– LDR r0,=0x55555555 => LDR r0,[PC,#Imm12]
…
…
DCD 0x55555555
• This is the recommended way of loading constants into a
register
 Multiply
• Syntax:
– MUL{<cond>}{S} Rd, Rm, Rs Rd = Rm * Rs
– MLA{<cond>}{S} Rd,Rm,Rs,Rn Rd = (Rm * Rs) + Rn
– [U|S]MULL{<cond>}{S} RdLo, RdHi, Rm, Rs RdHi,RdLo := Rm*Rs
– [U|S]MLAL{<cond>}{S} RdLo, RdHi, Rm, Rs RdHi,RdLo := (Rm*Rs)+RdHi,RdLo

• Cycle time
– Basic MUL instruction
• 2-5 cycles on ARM7TDMI
• 1-3 cycles on StrongARM/XScale
• 2 cycles on ARM9E/ARM102xE
– +1 cycle for ARM9TDMI (over ARM7TDMI)
– +1 cycle for accumulate (not on 9E though result delay is one cycle longer)
– +1 cycle for “long”

• Above are “general rules” - refer to the TRM for the core you are using for
the exact details
 Single register data transfer
LDR STR Word
LDRB STRB Byte
LDRH STRH Halfword
LDRSB Signed byte load
LDRSH Signed halfword load

• Memory system must support all access sizes

• Syntax:
– LDR{<cond>}{<size>} Rd, <address>
– STR{<cond>}{<size>} Rd, <address>

e.g. LDREQB
 Address accessed
• Address accessed by LDR/STR is specified by a base register
plus an offset
• For word and unsigned byte accesses, offset can be
– An unsigned 12-bit immediate value (ie 0 - 4095 bytes).
LDR r0,[r1,#8]

– A register, optionally shifted by an immediate value

LDR r0,[r1,r2]
LDR r0,[r1,r2,LSL#2]

• This can be either added or subtracted from the base

register:
LDR r0,[r1,#-8]
LDR r0,[r1,-r2]
LDR r0,[r1,-r2,LSL#2]
• For halfword and signed halfword / byte, offset can be:
– An unsigned 8 bit immediate value (ie 0-255 bytes).
– A register (unshifted).
• Choice of pre-indexed or post-indexed addressing
 Pre or Post Indexed Addressing?
• Pre-indexed: STR r0,[r1,#12]
Offset r0
Source
12 0x20c 0x5 0x5 Register
for STR
r1
Base
Register 0x200
0x200

Auto-update form: STR r0,[r1,#12]!

 Post-indexed: STR r0,[r1],#12

Updated r1 Offset
Base 0x20c 12
Register 0x20c
r0
Source
Original r1 0x5 Register
Base 0x5 for STR
0x200 0x200
Register
 LDM / STM operation
• Syntax:
<LDM|STM>{<cond>}<addressing_mode> Rb{!}, <register list>
• 4 addressing modes:
LDMIA / STMIA increment after
LDMIB / STMIB increment before
LDMDA / STMDA decrement after
LDMDB / STMDB decrement before
IA IB DA DB
LDMxx r10, {r0,r1,r4} r4
STMxx r10, {r0,r1,r4}
r4 r1
r1 r0 Increasing
Base Register (Rb) r10 r0 r4 Address
r1 r4
r0 r1
r0
 Software Interrupt (SWI) 0
31 28 27 24 23

Cond 1 1 1 1 SWI number (ignored by processor)

Condition Field
• Causes an exception trap to the SWI hardware
vector
• The SWI handler can examine the SWI number to
decide what operation has been requested.
• By using the SWI mechanism, an operating system
can implement a set of privileged operations which
applications running in user mode can request.
• Syntax:
– SWI{<cond>} <SWI number>
 31
PSR Transfer Instructions
28 27 24 23 16 15 8 7 6 5 4 0

NZCVQ J U n d e f i n e d I F T mode
f s x c
• MRS and MSR allow contents of CPSR / SPSR to be
transferred to / from a general purpose register.
• Syntax:
– MRS{<cond>} Rd,<psr> ; Rd = <psr>

– MSR{<cond>} <psr[_fields]>,Rm ; <psr[_fields]> = Rm

where
– <psr> = CPSR or SPSR
– [_fields] = any combination of ‘fsxc’

• Also an immediate form

– MSR{<cond>} <psr_fields>,#Immediate

• In User Mode, all bits can be read but only the condition flags
(_f) can be written.
 ARM Branches and Subroutines
• B <label>
– PC relative. ±32 Mbyte range.
• BL <subroutine>
– Stores return address in LR
– Returning implemented by restoring the PC from LR
– For non-leaf functions, LR will have to be stacked
func1 func2

STMFD :
: sp!,{regs,lr}
:
: :
:
BL func1 BL func2
:
: :
:
: LDMFD
sp!,{regs,pc} MOV pc, lr
•
Thumb
Thumb is a 16-bit instruction set
– Optimised for code density from C code (~65% of ARM code size)
– Improved performance from narrow memory
– Subset of the functionality of the ARM instruction set
• Core has additional execution state - Thumb
– Switch between ARM and Thumb using BX instruction
31 0
ADDS r2,r2,#1
32-bit ARM Instruction
For most instructions generated by compiler:
 Conditional execution is not used
 Source and destination registers identical
 Only Low registers used
 Constants are of limited size
15 0  Inline barrel shifter not used
ADD r2,#1
16-bit Thumb Instruction
Example ARM-based System

16 bit RAM 32 bit RAM

Interrupt
Controller
Peripherals I/O
nIRQ nFIQ

ARM
Core
8 bit ROM