第三講 ARM指令集

第三節(jié)ARM指令集凌明東南大學(xué)國(guó)家專用集成電路系統(tǒng)工程技術(shù)研究中心trio@trio@WhydoweneedtoknowtheinstructionsetARMandThumbinstructionsetsweredesignedtogivethebestoutputfromcompilersEspeciallytheThumbInstructionsetMostdesigneffortformanysystemsisfocussedoncompiledcodeandknowledgeoftheinstructionsetisnotrequiredBut…..EmbeddedsystemsrequireinitialisationcodeandinterruptroutinesAllsystemsrequiredebugging–possiblyattheinstructionlevelPerformancegainscanbemadebywritingassemblerroutinesSomefeaturesoftheARMarchitecturearenotavailablewithcompilers目錄ARM指令集匯編語(yǔ)言編程簡(jiǎn)介ARM指令集ARM指令集所有指令都是32位長(zhǎng)許多指令都是單周期指令指令可條件執(zhí)行LOAD/STORE架構(gòu)例數(shù)據(jù)處理指令SUBr0,r1,#5ADDr2,r3,r3,LSL#2ANDSr4,r4,#0x20ADDEQr5,r5,r6特定的訪問(wèn)存儲(chǔ)器的指令LDRR0,[R1],#4STRNEBr2,[r3,r4]LDRSHr5,[r6,#8]!STMFDsp!,{r0,r2-r7,r10}ARM指令的一般編碼格式ARM指令字長(zhǎng)為固定的32位。一條典型的ARM指令編碼格式如圖。Opcode 指令操作符編碼Cond 指令執(zhí)行的條件編碼S 決定指令的操作是否影響CPSR的值Rd 目標(biāo)寄存器編碼Rn 包含第1個(gè)操作數(shù)的寄存器編碼Shifter_operand 表示第二個(gè)操作數(shù)指令格式<opcode>{<cond>}{S}<Rd>,<Rn>{,<operand2>}ARMinstructionscanbemadetoexecuteconditionallybypost-fixingthemwiththeappropriateconditioncodeThiscanincreasecodedensityandincreaseperformancebyreducingthenumberofforwardbranches

CMPr0,r1ADDGTr2,r2,#1ADDLEr3,r3,#1Bydefault,dataprocessinginstructionsdonotaffecttheconditionflagsbutthiscanbeachievedbypostfixingtheinstruction(andanyconditioncode)withan“S”loopADDr2,r2,r3SUBSr1,r1,#0x01 BNE

loop

r2=r2+r3ifZflagclearthenbranchdecrementr1andsetflagsr0-r1,comparer0withr1andsetflagsif>r2=r2+1flagsremainunchangedif<=r3=r3+1flagsremainunchangedConditionalExecutionandFlagsConditionalexecutionexamplesif(r0==0){r1=r1+1;}else{r2=r2+1;}Csourcecode5instructions5words5or6cycles3instructions3words3cyclesCMPr0,#0BNEelseADDr1,r1,#1BendelseADDr2,r2,#1end...ARMinstructionsunconditionalCMPr0,#0ADDEQr1,r1,#1ADDNEr2,r2,#1...conditional條件碼條件執(zhí)行ARM指令可以通過(guò)增加條件執(zhí)行碼后綴來(lái)?xiàng)l件執(zhí)行這樣可以增加代碼密度，看下面的例子CMPr3,r0# CMPr3,#0 BEQskip ADDNEr0,r1,r2ADDr0,r1,r2skip缺省情況下，數(shù)據(jù)處理指令不影響條件碼標(biāo)志，但是條件碼標(biāo)志可由“S”來(lái)設(shè)置，CMP不需要加“S”SUBSr1,r1,#1 r1減1并設(shè)置標(biāo)志BNEloop 如果Z標(biāo)志清除則跳轉(zhuǎn)條件執(zhí)行的例子使用一系列條件執(zhí)行的指令I(lǐng)f(a==0)func(1);CMP r0,#0MOVEQ r0,#1BLEQ func設(shè)置標(biāo)志后使用不同的條件碼If(a==0)x=0;If(a>0)x=1;CMP r0,#0MOVEQ r1,#0MOVGT r1,#1使用條件比較指令I(lǐng)f(a==4||a==10) x=0;CMP r0,#4CMPNE r0,#10MOVEQ r1,#0DataprocessingInstructionsConsistof:Arithmetic: ADD ADC SUB SBC RSB RSCLogical: AND ORR EOR BICComparisons: CMP CMN TST TEQDatamovement: MOV MVNTheseinstructionsonlyworkonregisters,NOTmemory.Syntax:

<Operation>{<cond>}{S}Rd,Rn,Operand2Operand2canbearegisteroranimmediatevalueSUBr0,r1,r2 ANDr1,r4,#0xFFComparisonssetflagsonly-theydonotspecifyRdCMPr0,r3DatamovementdoesnotspecifyRnMOVr0,r1Operand2issenttotheALUviabarrelshifterRegister,optionallywithshiftoperationappliedShiftvaluecanbeeitherbe:5bitunsignedintegerSpecifiedinbottombyteofanotherregisterUsedformultiplicationbyconstantADDr0,r5,r5LSL1r0=r5x3Immediatevalue8bitnumber,witharangeof0-255.RotatedrightthroughevennumberofpositionsAllowsincreasedrangeof32-bitconstantstobeloadeddirectlyintoregistersResultOperand1Barrel

ShifterOperand2ALUTheSecondOperandShiftOperationsDestinationCF0DestinationCFLSL:LogicalLeftShiftASR:ArithmeticRightShiftMultiplicationbyapowerof2Divisionbyapowerof2,preservingthesignbitDestinationCF...0DestinationCFLSR:LogicalShiftRightROR:RotateRightDivisionbyapowerof2BitrotatewithwraparoundfromLSBtoMSBDestinationRRX:RotateRightExtendedSinglebitrotatewithwraparound

fromCFtoMSBCFTheseshiftoperationsareusedaspartofdataprocessinginstructions.bitscanbeshiftedfrom0-31places,typicallywithoutperformancepenaltyNoARMinstructioncancontaina32bitimmediateconstantAllARMinstructionsarefixedas32bitslongThedataprocessinginstructionformathas12bitsavailableforoperand24bitrotatevalue(0-15)ismultipliedbytwotogiverange0-30instepsof2Ruletorememberis

“8-bitsrotatedrightbyanevennumberofbitpositions”07118immed_8Shifter

RORrotx2QuickQuiz:

0xe3a004ff

MOVr0,#???Immediateconstants關(guān)于立即數(shù)的例子！匯編器把立即數(shù)轉(zhuǎn)換為移位的方式MOVr0,#0x4096； 0x40循環(huán)右移26位ADDr1,r2,#0xFF0000； 0xFF循環(huán)右移16位不能夠按照規(guī)則生成的立即數(shù)會(huì)導(dǎo)致錯(cuò)誤Toallowlargerconstantstobeloaded,theassembleroffersapseudo-instruction:LDRrd,=constThiswilleither:ProduceaMOVorMVNinstructiontogeneratethevalue(ifpossible) orGenerateaLDRinstructionwithaPC-relativeaddresstoreadtheconstantfromaliteralpool(Constantdataareaembeddedinthecode)ForexampleLDRr0,=0xFF => MOVr0,#0xFFLDRr0,=0x55555555

=>

LDRr0,[PC,#Imm12]

…

…

DCD0x55555555ThisistherecommendedwayofloadingconstantsintoaregisterLoading32bitconstantsThereare2classesofmultiply-producing32-bitand64-bitresults32-bitversionsonanARM7TDMIwillexecutein2-5cyclesMULr0,r1,r2 ;r0=r1*r2MLAr0,r1,r2,r3 ;r0=(r1*r2)+r364-bitmultiplyinstructionsofferbothsignedandunsignedversionsFortheseinstructionthereare2destinationregisters[U|S]MULLr4,r5,r2,r3 ;r5:r4=r2*r3[U|S]MLALr4,r5,r2,r3 ;r5:r4=(r2*r3)+r5:r4MostARMcoresdonotofferintegerdivideinstructionsDivisionoperationswillbeperformedbyClibraryroutinesorinlineshiftsMultiplyandDivide乘法MUL{條件}{S} 目的寄存器，操作數(shù)1，操作數(shù)2例：MULS R0，R1，R2 ；R0=R1×R2，同時(shí)設(shè)置CPSR中的相關(guān)條件標(biāo)志位MLA{條件}{S} 目的寄存器，操作數(shù)1，操作數(shù)2，操作數(shù)3MLAS R0，R1，R2，R3 ；R0=R1×R2+R3，同時(shí)設(shè)置CPSR中的相關(guān)條件標(biāo)志位SMULL、SMLAL、UMULL、UMLAL等乘法指令的執(zhí)行周期ARM7TDMI約為2－5個(gè)時(shí)鐘周期StrongARM/XScale約為1－3個(gè)時(shí)鐘周期ARM9E/ARM102xE約為2個(gè)時(shí)鐘周期跳轉(zhuǎn)指令B Label ；PC相對(duì)地址，32M范圍。程序無(wú)條件跳轉(zhuǎn)到標(biāo)號(hào)Label處執(zhí)行BL Label ；當(dāng)程序無(wú)條件跳轉(zhuǎn)到標(biāo)號(hào)Label處執(zhí)行時(shí)，同時(shí)將當(dāng)前的PC值保存到R14中在LR中保存返回地址子程序返回時(shí)從LR中恢復(fù)PC存儲(chǔ)在跳轉(zhuǎn)指令中的實(shí)際值是相對(duì)當(dāng)前PC值的一個(gè)偏移量，而不是一個(gè)絕對(duì)地址。它是24位有符號(hào)數(shù)，左移兩位后有符號(hào)擴(kuò)展為32位，表示的有效偏移為26位(前后32MB的地址空間)。利用相對(duì)PC的偏移量進(jìn)行跳轉(zhuǎn)的好處是可以生成PIC代碼。如果跳轉(zhuǎn)的空間超過(guò)32MB，如何處理？:BLfunc2::BXlrfunc1func2voidfunc1(void){

: func2(); :}子函數(shù)Implementingaconventionalsubroutinecallrequirestwosteps:StorethereturnaddressBranchtotheaddressoftherequiredsubroutineThesestepsarecarriedoutinoneinstruction,BLThereturnaddressisstoredinthelinkregister(lr/r14)Branchtoanaddressanywherewithina+/-32MBrangeReturningisperformedbyrestoringtheprogramcounter(pc)fromlr單寄存器數(shù)據(jù)傳送LDR STR

Word

LDRB STRB

Byte

LDRH STRH

Halfword

LDRSB

SignedbyteloadLDRSH

SignedhalfwordloadMemorysystemmustsupportallaccesssizesSyntax:LDR{<cond>}{<size>}Rd,<address>STR{<cond>}{<size>}Rd,<address>e.g.LDREQBLDR/STR指令的尋址方式AddressaccessedbyLDR/STRisspecifiedbyabaseregisterwithanoffsetForwordandunsignedbyteaccesses,offsetcanbe:Anunsigned12-bitimmediatevalue(i.e.0-4095bytes)

LDRr0,[r1,#8]Aregister,optionallyshiftedbyanimmediatevalue

LDRr0,[r1,r2]

LDRr0,[r1,r2,LSL#2]Thiscanbeeitheraddedorsubtractedfromthebaseregister:

LDRr0,[r1,#-8]

LDRr0,[r1,-r2,LSL#2]Forhalfwordandsignedhalfword/byte,offsetcanbe:Anunsigned8bitimmediatevalue(i.e.0-255bytes)Aregister(unshifted)Choiceofpre-indexedorpost-indexedaddressingChoiceofwhethertoupdatethebasepointer(pre-indexedonly)

LDRr0,[r1,#-8]!

0x50x5r10x200Base

Register0x200r00x5Source

Register

forSTROffset120x20cr10x200Original

Base

Register0x200r00x5Source

Register

forSTROffset120x20cr10x20cUpdated

Base

RegisterAuto-updateform:

STRr0,[r1,#12]!PreorPostIndexedAddressing?

Pre-indexed:

STRr0,[r1,#12]

Post-indexed:

STRr0,[r1],#12關(guān)于前變址后變址的小結(jié)Word或者unsignedbyteHalfword,signedhalf,signedbyte尋址方式1語(yǔ)法1尋址方式2語(yǔ)法2立即數(shù)偏移前變址[Rn,#+/-offset_12]立即數(shù)偏移前變址[Rn,#+/-offset_8]寄存器偏移前變址[Rn,+/-Rm]寄存器偏移前變址[Rn,+/-Rm]比例寄存器偏移前變址[Rn,+/-Rm,shift_imm]立即數(shù)偏移回寫(xiě)前變址[Rn,#+/-offset_12]!立即數(shù)偏移回寫(xiě)前變址[Rn,#+/-offset_8]!寄存器回寫(xiě)前變址[Rn,+/-Rm]!寄存器回寫(xiě)前變址[Rn,+/-Rm]!比例寄存器回寫(xiě)前變址[Rn,+/-Rm,shift_imm]!立即數(shù)后變址[Rn],#+/-offset_12立即數(shù)后變址[Rn],#+/-offset_8寄存器后變址[Rn],+/-Rm寄存器后變址[Rn],+/-Rm比例寄存器后變址[Rn],+/-Rm,shift_immGeneratingBrancheswithLDRTheARM’sbranchinstructionislimitedtoarangeof±32MBHoweverbranchescanalsobeperformedbyloadingaddressvaluesdirectlyintothePC(r15)armasmprovidespseudoinstructionstomakethiseasier

AssemblerCodeLDRpc,=label;loadaddressoflabelintoPCARMASM

ObjectCode

LDRpc,[pc,#n] .--------------DCD0x12345678LiteralpooladdressdataBranchesanywherewithinthe4GBaddressspacearethuspossibleTheuseofbaseregisterupdatingenablessimplecopyingroutinestobewrittenForexample:Thepost-indexedvariantcouldbeusedtocopyablockofmemory;r8pointstostartofsourcedata;r9pointstoendofsourcedata;r10pointstostartofdestinationdataloop LDR r0,[r8],#4 ;load4bytes STR r0,[r10],#4 ;andstorethem CMP r8,r9 ;checkfortheend BLT loop ;elseloopInthisexample1wordiscopiedperiterationMemoryBlockCopying(1)IncreasingMemoryr9r8r10塊數(shù)據(jù)傳送批量加載和存儲(chǔ)指令（LDM/STM）允許在存儲(chǔ)器和16個(gè)寄存器之間傳送數(shù)據(jù)寄存器的傳送順序不能任意指定低地址的內(nèi)容總是總是傳送到低寄存器例：LDMIAr10!,{r0,r1,r4}基址寄存器指定了訪問(wèn)存儲(chǔ)器的地址這些指令有效的用于：在存儲(chǔ)器中傳送數(shù)據(jù)塊在堆棧中保存和恢復(fù)上下文LDM/STM操作LDM（或STM）{條件}{類型}基址寄存器{！}，寄存器列表{∧}，例：LDMIAr12!,{r0-r11};由基址寄存器所指示的一片連續(xù)存儲(chǔ)器到寄存器列表所指示的多個(gè)寄存器之間傳送數(shù)據(jù)IA 每次傳送后地址加1；IB 每次傳送前地址加1；DA 每次傳送后地址減1；DB 每次傳送前地址減1；FD 滿遞減堆棧；ED 空遞減堆棧；FA 滿遞增堆棧；EA 空遞增堆棧；LoadandStoreMultiplesSyntax:<LDM|STM>{<cond>}<addressing_mode>Rb{!},<registerlist>4addressingmodes:LDMIA/STMIAincrementafter

LDMIB/STMIB incrementbefore

LDMDA/STMDAdecrementafter

LDMDB/STMDBdecrementbeforeIAr1Increasing

Addressr4r0r1r4r0r1r4r0r1r4r0r10IBDADBLDMxxr10,{r0,r1,r4}STMxxr10,{r0,r1,r4}BaseRegister(Rb)內(nèi)存塊拷貝！可以使得STM/LDM指令自動(dòng)更新基址寄存器對(duì)于IA、IB，寄存器的內(nèi)容加4對(duì)于DA、DB，寄存器的內(nèi)容減4例：；r12指向源數(shù)據(jù)的起始地址；r14指向源數(shù)據(jù)的結(jié)束地址；r13指向目標(biāo)數(shù)據(jù)的起始地址LoopLDMIAr12!,{r0-r11};STMIAr13!,{r0-r11};CMP r12,r14 BNE loopAswellasbeingusedforstackoperations,theSTM/LDM

instructionscanperformblockcopyingofmemoryForexample;r8pointstostartofsourcedata;r9pointstoendofsourcedata;r10pointstostartofdestinationdataloop LDMIA r8!,{r0-r7} ;load32bytes STMIA r10!,{r0-r7} ;andstorethem CMP r8,r9 ;checkfortheend BLT loop ;andloopInthisexample8wordsarecopiedperloopMemoryBlockCopying(2)IncreasingMemoryr9r8r10堆棧ARM的堆棧操作由塊傳送指令來(lái)實(shí)現(xiàn)STMFD （Push）批量存儲(chǔ)－滿遞減堆棧LDMFD （Pop）批量加載－滿遞減堆棧例：STMFDsp!,{r4-r7,lr}；現(xiàn)場(chǎng)保存，將r4－r7、lr入棧例：LDMFDsp!,{r4-r7,pc}^；恢復(fù)現(xiàn)場(chǎng)，異常處理返回StacksLDMFDsp!,{r4-r7,pc}SP100FF1234AOBE80341010123484209753r41r514544r60r712lr9048pc9020r4100100FFr5FF1234r61234A0BEr7A0BE8034pc8034r4100r5FFr61234r7A0BElr8034ABCD8765102E16FFFF1010123484209753TopofMemorySPSP100FF1234A0BE8034SPOldSP100FF1234A0BE8034ARMstackoperationsareimplementedblocktransferinstructions:STMFD

(Push) StoreMultiple-FullDescendingstack[STMDB]LDMFD

(Pop) LoadMultiple-FullDescendingstack[LDMIA]Note:MultipleregisterswillalwaysbestackedinregisterorderfromlowestregistertolowestmemorylocationTheorderregistersarespecifiedhasnoeffect.STMFDsp!,{r4-r7,lr}LowAddressHighAddressAtomicoperationofamemoryreadfollowedbyamemorywritewhichmovesabyteorwordbetweenregisterandmemory.Syntax:SWP{<cond>}{B}Rd,Rm,[Rn]CanbeusedtoimplementflagsCannotbegeneratedfromCusingarmcc-mustuseassemblerRmRd321tempMemoryRnSWP數(shù)據(jù)交換指令（SWP）指令格式SWP{條件}目的寄存器，源寄存器1，[源寄存器2]例：SWP R0，R1，[R2] ；將R2所指向的存儲(chǔ)器中的字?jǐn)?shù)據(jù)傳送到R0，同時(shí)將R1中的字?jǐn)?shù)據(jù)傳送到R2所指向的存儲(chǔ)單元。SWP R0，R0，[R1] ；該指令完成將R1所指向的存儲(chǔ)器中的字?jǐn)?shù)據(jù)與R0中的字?jǐn)?shù)據(jù)交換?？蓪?shí)現(xiàn)信號(hào)量操作I2C_SEM EQU 0x40003000I2C_SEM_WAITMOV R1,#0LDR R0,=I2C_SEMSWP R1,R1,[R0] ；取出信號(hào)量，并設(shè)置其為0CMP R1,#0 ；判斷是否有信號(hào)BEQ I2C_SEM_WAIT ；若沒(méi)有信號(hào)，則等待軟件中斷（SWI）產(chǎn)生一個(gè)軟件中斷異常SWI異常處理需要檢查SWI號(hào)，以確定進(jìn)行何種所請(qǐng)求的操作通過(guò)使用SWI機(jī)制，應(yīng)用程序可以在用戶模式下通過(guò)系統(tǒng)調(diào)用執(zhí)行一系列特權(quán)操作。例：SWI 0x02 ；調(diào)用操作系統(tǒng)編號(hào)為02的系統(tǒng)調(diào)用例程。SoftwareInterrupt(SWI)CausesanexceptiontraptotheSWIhardwarevectorTheSWIhandlercanexaminetheSWInumbertodecidewhatoperationhasbeenrequested.ByusingtheSWImechanism,anoperatingsystemcanimplementasetofprivilegedoperationswhichapplicationsrunninginusermodecanrequest.Syntax:

SWI{<cond>}<SWInumber>283124270Cond1111SWInumber(ignoredbyprocessor)23ConditionFieldSWI中斷處理程序?qū)嵗齋WI_handler ; ;保存寄存器r0~r12和lr ； STMFDsp!,{r0-r12,lr} ;讀SWI指令 LDRr10,[lr,#-4] ；屏蔽高8位 BICr10,r10,#0xff000000 ;r10中是SWI號(hào) BLservice_routine ;returnfromSWI LDMFDsp!,{r0-r12,pc}^

PSR傳送指令MRS和MSR指令允許傳送CPSR/SPSR的值到一個(gè)通用寄存器，或反之例：MRS R0，SPSR；傳送SPSR的內(nèi)容到R0在用戶模式下，所有的位均可讀，但是只有條件標(biāo)志可寫(xiě)。協(xié)處理器指令A(yù)RM的體系結(jié)構(gòu)支持16個(gè)協(xié)處理器每一個(gè)協(xié)處理器指令都占用ARM指令集的固定部分如果指令中的協(xié)處理器在系統(tǒng)中并不存在，會(huì)產(chǎn)生一個(gè)未定義指令異常有三種類型的協(xié)處理器指令協(xié)處理器數(shù)據(jù)處理CDP：初始化協(xié)處理器數(shù)據(jù)處理操作協(xié)處理器寄存器傳送MRC：從協(xié)處理器寄存器傳送到ARM寄存器MCR：從ARM寄存器傳送到協(xié)處理器寄存器協(xié)處理器存儲(chǔ)器傳送指令LDC：從存儲(chǔ)器中加載協(xié)處理器寄存器STC：把協(xié)處理器寄存器的值存到存儲(chǔ)器中ARM指令集總結(jié)跳轉(zhuǎn)指令數(shù)據(jù)處理指令乘法指令狀態(tài)寄存器訪問(wèn)指令Load/Store內(nèi)存訪問(wèn)指令批量Load/Store內(nèi)存訪問(wèn)指令信號(hào)量操作指令SWI系統(tǒng)調(diào)用指令A(yù)RM協(xié)處理器指令A(yù)RM匯編語(yǔ)言偽指令A(yù)RM中偽指令不是真正的ARM指令，這些偽指令在匯編編譯器堆源程序進(jìn)行匯編處理時(shí)被替換成對(duì)應(yīng)的ARM指令。ADR（小范圍的地址讀取偽指令）ADRL（中等范圍的地址讀取偽指令）LDR（大范圍的地址讀取偽指令）將一個(gè)32位的常數(shù)或者一個(gè)地址值讀取到寄存器中LDRR1,=0x12345678NOP空操作偽指令A(yù)RM匯編語(yǔ)言編程ARM匯編的程序設(shè)計(jì)ARM匯編語(yǔ)言以段(section)為單位組織源文件；段是相對(duì)獨(dú)立，具有特定名稱，不可分割的指令或數(shù)據(jù)序列；段分為代碼段和數(shù)據(jù)