第三講 ARM指令集

第三節(jié)ARM指令集凌明東南大學國家專用集成電路系統(tǒng)工程技術(shù)研究中心trio@trio@WhydoweneedtoknowtheinstructionsetARMandThumbinstructionsetsweredesignedtogivethebestoutputfromcompilersEspeciallytheThumbInstructionsetMostdesigneffortformanysystemsisfocussedoncompiledcodeandknowledgeoftheinstructionsetisnotrequiredBut…..EmbeddedsystemsrequireinitialisationcodeandinterruptroutinesAllsystemsrequiredebugging–possiblyattheinstructionlevelPerformancegainscanbemadebywritingassemblerroutinesSomefeaturesoftheARMarchitecturearenotavailablewithcompilers目錄ARM指令集匯編語言編程簡介ARM指令集ARM指令集所有指令都是32位長許多指令都是單周期指令指令可條件執(zhí)行LOAD/STORE架構(gòu)例數(shù)據(jù)處理指令SUBr0,r1,#5ADDr2,r3,r3,LSL#2ANDSr4,r4,#0x20ADDEQr5,r5,r6特定的訪問存儲器的指令LDRR0,[R1],#4STRNEBr2,[r3,r4]LDRSHr5,[r6,#8]!STMFDsp!,{r0,r2-r7,r10}ARM指令的一般編碼格式ARM指令字長為固定的32位。一條典型的ARM指令編碼格式如圖。Opcode 指令操作符編碼Cond 指令執(zhí)行的條件編碼S 決定指令的操作是否影響CPSR的值Rd 目標寄存器編碼Rn 包含第1個操作數(shù)的寄存器編碼Shifter_operand 表示第二個操作數(shù)指令格式<opcode>{<cond>}{S}<Rd>,<Rn>{,<operand2>}ARMinstructionscanbemadetoexecuteconditionallybypost-fixingthemwiththeappropriateconditioncodeThiscanincreasecodedensityandincreaseperformancebyreducingthenumberofforwardbranches

CMPr0,r1ADDGTr2,r2,#1ADDLEr3,r3,#1Bydefault,dataprocessinginstructionsdonotaffecttheconditionflagsbutthiscanbeachievedbypostfixingtheinstruction(andanyconditioncode)withan“S”loopADDr2,r2,r3SUBSr1,r1,#0x01 BNE

loop

r2=r2+r3ifZflagclearthenbranchdecrementr1andsetflagsr0-r1,comparer0withr1andsetflagsif>r2=r2+1flagsremainunchangedif<=r3=r3+1flagsremainunchangedConditionalExecutionandFlagsConditionalexecutionexamplesif(r0==0){r1=r1+1;}else{r2=r2+1;}Csourcecode5instructions5words5or6cycles3instructions3words3cyclesCMPr0,#0BNEelseADDr1,r1,#1BendelseADDr2,r2,#1end...ARMinstructionsunconditionalCMPr0,#0ADDEQr1,r1,#1ADDNEr2,r2,#1...conditional條件碼條件執(zhí)行ARM指令可以通過增加條件執(zhí)行碼后綴來條件執(zhí)行這樣可以增加代碼密度，看下面的例子CMPr3,r0# CMPr3,#0 BEQskip ADDNEr0,r1,r2ADDr0,r1,r2skip缺省情況下，數(shù)據(jù)處理指令不影響條件碼標志，但是條件碼標志可由“S”來設(shè)置，CMP不需要加“S”SUBSr1,r1,#1 r1減1并設(shè)置標志BNEloop 如果Z標志清除則跳轉(zhuǎn)條件執(zhí)行的例子使用一系列條件執(zhí)行的指令I(lǐng)f(a==0)func(1);CMP r0,#0MOVEQ r0,#1BLEQ func設(shè)置標志后使用不同的條件碼If(a==0)x=0;If(a>0)x=1;CMP r0,#0MOVEQ r1,#0MOVGT r1,#1使用條件比較指令I(lǐng)f(a==4||a==10) x=0;CMP r0,#4CMPNE r0,#10MOVEQ r1,#0DataprocessingInstructionsConsistof:Arithmetic: ADD ADC SUB SBC RSB RSCLogical: AND ORR EOR BICComparisons: CMP CMN TST TEQDatamovement: MOV MVNTheseinstructionsonlyworkonregisters,NOTmemory.Syntax:

<Operation>{<cond>}{S}Rd,Rn,Operand2Operand2canbearegisteroranimmediatevalueSUBr0,r1,r2 ANDr1,r4,#0xFFComparisonssetflagsonly-theydonotspecifyRdCMPr0,r3DatamovementdoesnotspecifyRnMOVr0,r1Operand2issenttotheALUviabarrelshifterRegister,optionallywithshiftoperationappliedShiftvaluecanbeeitherbe:5bitunsignedintegerSpecifiedinbottombyteofanotherregisterUsedformultiplicationbyconstantADDr0,r5,r5LSL1r0=r5x3Immediatevalue8bitnumber,witharangeof0-255.RotatedrightthroughevennumberofpositionsAllowsincreasedrangeof32-bitconstantstobeloadeddirectlyintoregistersResultOperand1Barrel

ShifterOperand2ALUTheSecondOperandShiftOperationsDestinationCF0DestinationCFLSL:LogicalLeftShiftASR:ArithmeticRightShiftMultiplicationbyapowerof2Divisionbyapowerof2,preservingthesignbitDestinationCF...0DestinationCFLSR:LogicalShiftRightROR:RotateRightDivisionbyapowerof2BitrotatewithwraparoundfromLSBtoMSBDestinationRRX:RotateRightExtendedSinglebitrotatewithwraparound

fromCFtoMSBCFTheseshiftoperationsareusedaspartofdataprocessinginstructions.bitscanbeshiftedfrom0-31places,typicallywithoutperformancepenaltyNoARMinstructioncancontaina32bitimmediateconstantAllARMinstructionsarefixedas32bitslongThedataprocessinginstructionformathas12bitsavailableforoperand24bitrotatevalue(0-15)ismultipliedbytwotogiverange0-30instepsof2Ruletorememberis

“8-bitsrotatedrightbyanevennumberofbitpositions”07118immed_8Shifter

RORrotx2QuickQuiz:

0xe3a004ff

MOVr0,#???Immediateconstants關(guān)于立即數(shù)的例子！匯編器把立即數(shù)轉(zhuǎn)換為移位的方式MOVr0,#0x4096； 0x40循環(huán)右移26位ADDr1,r2,#0xFF0000； 0xFF循環(huán)右移16位不能夠按照規(guī)則生成的立即數(shù)會導致錯誤Toallowlargerconstantstobeloaded,theassembleroffersapseudo-instruction:LDRrd,=constThiswilleither:ProduceaMOVorMVNinstructiontogeneratethevalue(ifpossible) orGenerateaLDRinstructionwithaPC-relativeaddresstoreadtheconstantfromaliteralpool(Constantdataareaembeddedinthecode)ForexampleLDRr0,=0xFF => MOVr0,#0xFFLDRr0,=0x55555555

=>

LDRr0,[PC,#Imm12]

…

…

DCD0x55555555ThisistherecommendedwayofloadingconstantsintoaregisterLoading32bitconstantsThereare2classesofmultiply-producing32-bitand64-bitresults32-bitversionsonanARM7TDMIwillexecutein2-5cyclesMULr0,r1,r2 ;r0=r1*r2MLAr0,r1,r2,r3 ;r0=(r1*r2)+r364-bitmultiplyinstructionsofferbothsignedandunsignedversionsFortheseinstructionthereare2destinationregisters[U|S]MULLr4,r5,r2,r3 ;r5:r4=r2*r3[U|S]MLALr4,r5,r2,r3 ;r5:r4=(r2*r3)+r5:r4MostARMcoresdonotofferintegerdivideinstructionsDivisionoperationswillbeperformedbyClibraryroutinesorinlineshiftsMultiplyandDivide乘法MUL{條件}{S} 目的寄存器，操作數(shù)1，操作數(shù)2例：MULS R0，R1，R2 ；R0=R1×R2，同時設(shè)置CPSR中的相關(guān)條件標志位MLA{條件}{S} 目的寄存器，操作數(shù)1，操作數(shù)2，操作數(shù)3MLAS R0，R1，R2，R3 ；R0=R1×R2+R3，同時設(shè)置CPSR中的相關(guān)條件標志位SMULL、SMLAL、UMULL、UMLAL等乘法指令的執(zhí)行周期ARM7TDMI約為2－5個時鐘周期StrongARM/XScale約為1－3個時鐘周期ARM9E/ARM102xE約為2個時鐘周期跳轉(zhuǎn)指令B Label ；PC相對地址，32M范圍。程序無條件跳轉(zhuǎn)到標號Label處執(zhí)行BL Label ；當程序無條件跳轉(zhuǎn)到標號Label處執(zhí)行時，同時將當前的PC值保存到R14中在LR中保存返回地址子程序返回時從LR中恢復PC存儲在跳轉(zhuǎn)指令中的實際值是相對當前PC值的一個偏移量，而不是一個絕對地址。它是24位有符號數(shù)，左移兩位后有符號擴展為32位，表示的有效偏移為26位(前后32MB的地址空間)。利用相對PC的偏移量進行跳轉(zhuǎn)的好處是可以生成PIC代碼。如果跳轉(zhuǎn)的空間超過32MB，如何處理？:BLfunc2::BXlrfunc1func2voidfunc1(void){

: func2(); :}子函數(shù)Implementingaconventionalsubroutinecallrequirestwosteps:StorethereturnaddressBranchtotheaddressoftherequiredsubroutineThesestepsarecarriedoutinoneinstruction,BLThereturnaddressisstoredinthelinkregister(lr/r14)Branchtoanaddressanywherewithina+/-32MBrangeReturningisperformedbyrestoringtheprogramcounter(pc)fromlr單寄存器數(shù)據(jù)傳送LDR STR

Word

LDRB STRB

Byte

LDRH STRH

Halfword

LDRSB

SignedbyteloadLDRSH

SignedhalfwordloadMemorysystemmustsupportallaccesssizesSyntax:LDR{<cond>}{<size>}Rd,<address>STR{<cond>}{<size>}Rd,<address>e.g.LDREQBLDR/STR指令的尋址方式AddressaccessedbyLDR/STRisspecifiedbyabaseregisterwithanoffsetForwordandunsignedbyteaccesses,offsetcanbe:Anunsigned12-bitimmediatevalue(i.e.0-4095bytes)

LDRr0,[r1,#8]Aregister,optionallyshiftedbyanimmediatevalue

LDRr0,[r1,r2]

LDRr0,[r1,r2,LSL#2]Thiscanbeeitheraddedorsubtractedfromthebaseregister:

LDRr0,[r1,#-8]

LDRr0,[r1,-r2,LSL#2]Forhalfwordandsignedhalfword/byte,offsetcanbe:Anunsigned8bitimmediatevalue(i.e.0-255bytes)Aregister(unshifted)Choiceofpre-indexedorpost-indexedaddressingChoiceofwhethertoupdatethebasepointer(pre-indexedonly)

LDRr0,[r1,#-8]!

0x50x5r10x200Base

Register0x200r00x5Source

Register

forSTROffset120x20cr10x200Original

Base

Register0x200r00x5Source

Register

forSTROffset120x20cr10x20cUpdated

Base

RegisterAuto-updateform:

STRr0,[r1,#12]!PreorPostIndexedAddressing?

Pre-indexed:

STRr0,[r1,#12]

Post-indexed:

STRr0,[r1],#12關(guān)于前變址后變址的小結(jié)Word或者unsignedbyteHalfword,signedhalf,signedbyte尋址方式1語法1尋址方式2語法2立即數(shù)偏移前變址[Rn,#+/-offset_12]立即數(shù)偏移前變址[Rn,#+/-offset_8]寄存器偏移前變址[Rn,+/-Rm]寄存器偏移前變址[Rn,+/-Rm]比例寄存器偏移前變址[Rn,+/-Rm,shift_imm]立即數(shù)偏移回寫前變址[Rn,#+/-offset_12]!立即數(shù)偏移回寫前變址[Rn,#+/-offset_8]!寄存器回寫前變址[Rn,+/-Rm]!寄存器回寫前變址[Rn,+/-Rm]!比例寄存器回寫前變址[Rn,+/-Rm,shift_imm]!立即數(shù)后變址[Rn],#+/-offset_12立即數(shù)后變址[Rn],#+/-offset_8寄存器后變址[Rn],+/-Rm寄存器后變址[Rn],+/-Rm比例寄存器后變址[Rn],+/-Rm,shift_immGeneratingBrancheswithLDRTheARM’sbranchinstructionislimitedtoarangeof±32MBHoweverbranchescanalsobeperformedbyloadingaddressvaluesdirectlyintothePC(r15)armasmprovidespseudoinstructionstomakethiseasier

AssemblerCodeLDRpc,=label;loadaddressoflabelintoPCARMASM

ObjectCode

LDRpc,[pc,#n] .--------------DCD0x12345678LiteralpooladdressdataBranchesanywherewithinthe4GBaddressspacearethuspossibleTheuseofbaseregisterupdatingenablessimplecopyingroutinestobewrittenForexample:Thepost-indexedvariantcouldbeusedtocopyablockofmemory;r8pointstostartofsourcedata;r9pointstoendofsourcedata;r10pointstostartofdestinationdataloop LDR r0,[r8],#4 ;load4bytes STR r0,[r10],#4 ;andstorethem CMP r8,r9 ;checkfortheend BLT loop ;elseloopInthisexample1wordiscopiedperiterationMemoryBlockCopying(1)IncreasingMemoryr9r8r10塊數(shù)據(jù)傳送批量加載和存儲指令（LDM/STM）允許在存儲器和16個寄存器之間傳送數(shù)據(jù)寄存器的傳送順序不能任意指定低地址的內(nèi)容總是總是傳送到低寄存器例：LDMIAr10!,{r0,r1,r4}基址寄存器指定了訪問存儲器的地址這些指令有效的用于：在存儲器中傳送數(shù)據(jù)塊在堆棧中保存和恢復上下文LDM/STM操作LDM（或STM）{條件}{類型}基址寄存器{！}，寄存器列表{∧}，例：LDMIAr12!,{r0-r11};由基址寄存器所指示的一片連續(xù)存儲器到寄存器列表所指示的多個寄存器之間傳送數(shù)據(jù)IA 每次傳送后地址加1；IB 每次傳送前地址加1；DA 每次傳送后地址減1；DB 每次傳送前地址減1；FD 滿遞減堆棧；ED 空遞減堆棧；FA 滿遞增堆棧；EA 空遞增堆棧；LoadandStoreMultiplesSyntax:<LDM|STM>{<cond>}<addressing_mode>Rb{!},<registerlist>4addressingmodes:LDMIA/STMIAincrementafter

LDMIB/STMIB incrementbefore

LDMDA/STMDAdecrementafter

LDMDB/STMDBdecrementbeforeIAr1Increasing

Addressr4r0r1r4r0r1r4r0r1r4r0r10IBDADBLDMxxr10,{r0,r1,r4}STMxxr10,{r0,r1,r4}BaseRegister(Rb)內(nèi)存塊拷貝！可以使得STM/LDM指令自動更新基址寄存器對于IA、IB，寄存器的內(nèi)容加4對于DA、DB，寄存器的內(nèi)容減4例：；r12指向源數(shù)據(jù)的起始地址；r14指向源數(shù)據(jù)的結(jié)束地址；r13指向目標數(shù)據(jù)的起始地址LoopLDMIAr12!,{r0-r11};STMIAr13!,{r0-r11};CMP r12,r14 BNE loopAswellasbeingusedforstackoperations,theSTM/LDM

instructionscanperformblockcopyingofmemoryForexample;r8pointstostartofsourcedata;r9pointstoendofsourcedata;r10pointstostartofdestinationdataloop LDMIA r8!,{r0-r7} ;load32bytes STMIA r10!,{r0-r7} ;andstorethem CMP r8,r9 ;checkfortheend BLT loop ;andloopInthisexample8wordsarecopiedperloopMemoryBlockCopying(2)IncreasingMemoryr9r8r10堆棧ARM的堆棧操作由塊傳送指令來實現(xiàn)STMFD （Push）批量存儲－滿遞減堆棧LDMFD （Pop）批量加載－滿遞減堆棧例：STMFDsp!,{r4-r7,lr}；現(xiàn)場保存，將r4－r7、lr入棧例：LDMFDsp!,{r4-r7,pc}^；恢復現(xiàn)場，異常處理返回StacksLDMFDsp!,{r4-r7,pc}SP100FF1234AOBE80341010123484209753r41r514544r60r712lr9048pc9020r4100100FFr5FF1234r61234A0BEr7A0BE8034pc8034r4100r5FFr61234r7A0BElr8034ABCD8765102E16FFFF1010123484209753TopofMemorySPSP100FF1234A0BE8034SPOldSP100FF1234A0BE8034ARMstackoperationsareimplementedblocktransferinstructions:STMFD

(Push) StoreMultiple-FullDescendingstack[STMDB]LDMFD

(Pop) LoadMultiple-FullDescendingstack[LDMIA]Note:MultipleregisterswillalwaysbestackedinregisterorderfromlowestregistertolowestmemorylocationTheorderregistersarespecifiedhasnoeffect.STMFDsp!,{r4-r7,lr}LowAddressHighAddressAtomicoperationofamemoryreadfollowedbyamemorywritewhichmovesabyteorwordbetweenregisterandmemory.Syntax:SWP{<cond>}{B}Rd,Rm,[Rn]CanbeusedtoimplementflagsCannotbegeneratedfromCusingarmcc-mustuseassemblerRmRd321tempMemoryRnSWP數(shù)據(jù)交換指令（SWP）指令格式SWP{條件}目的寄存器，源寄存器1，[源寄存器2]例：SWP R0，R1，[R2] ；將R2所指向的存儲器中的字數(shù)據(jù)傳送到R0，同時將R1中的字數(shù)據(jù)傳送到R2所指向的存儲單元。SWP R0，R0，[R1] ；該指令完成將R1所指向的存儲器中的字數(shù)據(jù)與R0中的字數(shù)據(jù)交換?？蓪崿F(xiàn)信號量操作I2C_SEM EQU 0x40003000I2C_SEM_WAITMOV R1,#0LDR R0,=I2C_SEMSWP R1,R1,[R0] ；取出信號量，并設(shè)置其為0CMP R1,#0 ；判斷是否有信號BEQ I2C_SEM_WAIT ；若沒有信號，則等待軟件中斷（SWI）產(chǎn)生一個軟件中斷異常SWI異常處理需要檢查SWI號，以確定進行何種所請求的操作通過使用SWI機制，應用程序可以在用戶模式下通過系統(tǒng)調(diào)用執(zhí)行一系列特權(quán)操作。例：SWI 0x02 ；調(diào)用操作系統(tǒng)編號為02的系統(tǒng)調(diào)用例程。SoftwareInterrupt(SWI)CausesanexceptiontraptotheSWIhardwarevectorTheSWIhandlercanexaminetheSWInumbertodecidewhatoperationhasbeenrequested.ByusingtheSWImechanism,anoperatingsystemcanimplementasetofprivilegedoperationswhichapplicationsrunninginusermodecanrequest.Syntax:

SWI{<cond>}<SWInumber>283124270Cond1111SWInumber(ignoredbyprocessor)23ConditionFieldSWI中斷處理程序?qū)嵗齋WI_handler ; ;保存寄存器r0~r12和lr ； STMFDsp!,{r0-r12,lr} ;讀SWI指令 LDRr10,[lr,#-4] ；屏蔽高8位 BICr10,r10,#0xff000000 ;r10中是SWI號 BLservice_routine ;returnfromSWI LDMFDsp!,{r0-r12,pc}^

PSR傳送指令MRS和MSR指令允許傳送CPSR/SPSR的值到一個通用寄存器，或反之例：MRS R0，SPSR；傳送SPSR的內(nèi)容到R0在用戶模式下，所有的位均可讀，但是只有條件標志可寫。協(xié)處理器指令ARM的體系結(jié)構(gòu)支持16個協(xié)處理器每一個協(xié)處理器指令都占用ARM指令集的固定部分如果指令中的協(xié)處理器在系統(tǒng)中并不存在，會產(chǎn)生一個未定義指令異常有三種類型的協(xié)處理器指令協(xié)處理器數(shù)據(jù)處理CDP：初始化協(xié)處理器數(shù)據(jù)處理操作協(xié)處理器寄存器傳送MRC：從協(xié)處理器寄存器傳送到ARM寄存器MCR：從ARM寄存器傳送到協(xié)處理器寄存器協(xié)處理器存儲器傳送指令LDC：從存儲器中加載協(xié)處理器寄存器STC：把協(xié)處理器寄存器的值存到存儲器中ARM指令集總結(jié)跳轉(zhuǎn)指令數(shù)據(jù)處理指令乘法指令狀態(tài)寄存器訪問指令Load/Store內(nèi)存訪問指令批量Load/Store內(nèi)存訪問指令信號量操作指令SWI系統(tǒng)調(diào)用指令ARM協(xié)處理器指令ARM匯編語言偽指令ARM中偽指令不是真正的ARM指令，這些偽指令在匯編編譯器堆源程序進行匯編處理時被替換成對應的ARM指令。ADR（小范圍的地址讀取偽指令）ADRL（中等范圍的地址讀取偽指令）LDR（大范圍的地址讀取偽指令）將一個32位的常數(shù)或者一個地址值讀取到寄存器中LDRR1,=0x12345678NOP空操作偽指令ARM匯編語言編程ARM匯編的程序設(shè)計ARM匯編語言以段(section)為單位組織源文件；段是相對獨立，具有特定名稱，不可分割的指令或數(shù)據(jù)序列；段分為代碼段和數(shù)據(jù)