3.1. Loads and Stores#

The first group of instructions transfers data between memory and the general-purpose registers. An instruction that transfers data from memory to a register is called a load. Conversely, an instruction that transfers data from a register to memory is called a store.

int32_t load_store_0( int32_t const * a );

    .text
    .type load_store_0, %function
    .global load_store_0
load_store_0:
    ldr w0, [x0]
    ret

int32_t load_store_1( int32_t const * a );

    .text
    .type load_store_1, %function
    .global load_store_1
load_store_1:
    ldr w0, [x0, #16]
    ret

void load_store_2( uint64_t const * a,
                   uint64_t       * b );

    .text
    .type load_store_2, %function
    .global load_store_2
load_store_2:
    ldr x0, [x0]
    str x0, [x1]
    ret

void load_store_3( int64_t const * a,
                   int64_t       * b );

    .text
    .type load_store_3, %function
    .global load_store_3
load_store_3:
    ldp x2, x3, [x0]
    stp x2, x3, [x1]
    ret

3.2. Machine Code#

In Section 2.3 we have already seen that we can use the assembler to translate assembly code into instruction words. We use the term instruction word to refer to the full 32-bit encoding of a single A64 instruction (sometimes also called the instruction encoding). However, we only briefly looked at the instruction stp x29, x30, [sp, -16]! and its instruction word 0b10101001101111110111101111111101. Now, with our knowledge of the structure of LDR (immediate), we can easily see the structure of the instruction word.

The following table shows the assembly code and corresponding instruction words of LDR (immediate), unsigned offset instructions:

The first row shows the IDs of the bits, where the most significant instruction bit is given by the bit with ID 31 and the least significant one by the bit with ID 0. The second row shows the location of the three fields imm12, Rn, and Rt as described in the A64 ISA. The immediate imm12 has a total of 12 bits and encodes the offset. The IDs of the two registers used are encoded in the fields Rn and Rt. The third row shows a short form of the instruction word pattern. The nine bits with IDs 22-29 and ID 31 are fixed, all other bits depend on how the instruction is used. We will go through the examples one by one:

ldr w0, [x0]

General-purpose register W0 has ID 0, encoded in field Rt, so we have the value 00000 in bits 4-0. Register X0 also has the ID 0, encoded in the Rn field. We have not specified an offset. According to the A64 ISA, the offset is set to 0 by default and we get the value 000000000000 in bits 21-10. We are loading the data into a W register, so we are using the 32-bit variant of the instruction. This information is stored in the size bit s, which has bit ID 30 and is 0 in this case.

ldr w1, [x0]

Compared to the previous example, only the ID of the 32-bit W register has changed. Therefore, we now have the value 00001 in bits 4-0.

ldr w5, [x0]

Again, only the ID of the W register has changed and we get 00101 for bits 4-0.

ldr x1, [x3]

The IDs of both registers changed. Thus, we get 00001 for Rt and 00011 for Rn. Additionally, we are now loading 64 bits into register X1. This means that the s bit with ID 30 is set to 1.

ldr x1, [x3, #32]

Compared to the previous instruction, we now load from a different location in memory. Specifically, the address is given by the value in register X3 with an added offset of 32 bytes. The offset is encoded in the field imm12 as 000000000100. Note that the offset is specified in eight-byte increments. In other words, ${100}_2=4_{10}$, i.e. we obtain the effective offset as $4\cdot 8=32$.

ldr x1, [x3, #4088]

Only the offset has changed, which is now encoded as 000111111111 in the imm12 field: $11111{1111}_2={511}_{10}$ and $511\cdot 8=4088$.

ldr w1, [x3, #2044]

This is an interesting example because, at first glance, two properties change. First, we are now loading 32 bits instead of 64 bits. Second, we have an offset of 2044 bytes instead of 4088 bytes. However, the offset of the 32-bit variant of LDR (immediate) is specified in 4-byte increments. This means that the numeric value in the field imm12 is identical to the one before: 000111111111. Comparing the instruction word of this instruction to the previous one, only the s bit with ID 30 changes from 1 to 0.

ldr x0, [x0, #32760]

In this case, we load 64 bits from memory into register X0. The data is loaded from the address that we get by adding the offset 32760 to the value in register X0. The immediate is now 111111111111, i.e. 32760 is the largest offset that can be encoded in the imm12 field of the 64-bit variant of the instruction.

.word 0xb9400000

We can also write the instruction word of an instruction directly. In this case, 0xb9400000 is simply the hexadecimal representation of the 32 instruction bits of ldr w0, [x0].

.word 0xb9400001

Hexadecimal representation of the instruction ldr w1, [x0].

.word 0xf97ffc00

Hexadecimal representation of the instruction ldr x0, [x0, #32760].

3.3. Addressing Modes#

The A64 instruction set has several addressing modes for loading and storing data. In general, load and store instructions use a 64-bit base address along with an optional offset. The base address is held in one of the 31 general-purpose registers, the stack pointer, or the program counter. The offset can be encoded directly as an immediate in the 32 instruction bits or held in an offset register.

Following C1.3.3 of the Arm Architecture Reference Manual for A-profile architecture, the most important addressing modes can be summarized as follows:

Base register only: [base(, #0)]

In the simplest case, we use only the base register to determine the memory address.

Listing 3.3.1 Implementation of the addressing_modes_0 function, which copies 32 bits from one memory location to another.#

    .section .text
    .type addressing_modes_0, %function
    .global addressing_modes_0
addressing_modes_0:
    ldr w2, [x0, #0]
    str w2, [x1, #0]
    ret

The example function in Listing 3.3.1 shows the base register only addressing mode. Specifically, the function copies 32 bits from memory at the address given by the value in X0 to the memory address given by the value in X1. The immediate offsets of load ldr w2, [x0, #0] and store str w2, [x1, #0] are explicitly set to zero. Alternatively, we could write ldr w2, [x0] for the load and str w2, [x1] for the store. Note that both forms result in the same instruction word because the offset is set to zero by default in the unsigned offset class of LDR (immediate) and STR (immediate).

Base plus immediate offset: [base(, #imm)]

Another addressing mode is given by a base address together with an immediate offset. In this case, the effective memory address is calculated by adding the immediate offset to the base address. Since the immediate is limited in size, the number of possible immediate offsets is also limited. In the case of LDR (immediate), the immediate has a size of 12 bits. Furthermore, in the 32-bit variant of the instruction, only positive multiples of 4 are encoded as immediates. This results in an offset range of 0 to 16380 for this variant because $2^{12}\cdot 4=16380$.

Listing 3.3.2 Implementation of the addressing_modes_1 function, which copies 32 bits from one memory location to another.#

    .section .text
    .type addressing_modes_1, %function
    .global addressing_modes_1
addressing_modes_1:
    ldr w2, [x0, #8]
    str w2, [x1, #12]
    ret

The example function in Listing 3.3.2 shows the base plus immediate offset addressing mode. Unlike before, the effective address for the 32-bit load ldr w2, [x0, #8] is determined by adding 8 to the value in register X0. The effective address for the 32-bit store str w2, [x1, #12] is determined by adding 12 to the value in register X1.

Base plus register offset: [base, Xm(, LSL #imm)]

In addition to immediate offsets, we can also provide the offset through an additional register. In this case, the offset can be any 64-bit value. We can also encode an additional left shift of the offset as part of the instruction.

Listing 3.3.3 Implementation of the addressing_modes_2 function, which copies 32 bits from one memory location to another.#

    .section .text
    .type addressing_modes_2, %function
    .global addressing_modes_2
addressing_modes_2:
    ldr w4, [x0, x1]
    str w4, [x2, x3]
    ret

The example function in Listing 3.3.3 illustrates the base plus register offset addressing modes. The ldr w4, [x0, x1] instruction uses LDR (register). This means that the effective memory address is calculated by adding the 64-bit value in X0 to the value in X1. In this case, the effective address for the load is given by adding the values in X0 and X1. The effective address for the store str w4, [x2, x3] is given by adding the values in X2 and X3.

Pre-indexed: [base, #imm]!

So far we have only discussed addressing modes that leave the register holding the base address untouched. In contrast, pre-indexed instructions calculate the effective address by adding the immediate offset to the base address and also write this address back to the register that held the base address.

Listing 3.3.4 Implementation of the addressing_modes_3 function, which copies 2x32 bits from one memory location to another.#

    .section .text
    .type addressing_modes_3, %function
    .global addressing_modes_3
addressing_modes_3:
    ldr w2, [x0, #4]!
    str w2, [x1, #4]!
    ldr w2, [x0, #4]!
    str w2, [x1, #4]!
    ret

Listing 3.3.4 illustrates the use of pre-indexed loads and stores. The pre-indexed load ldr w2, [x0, #4]! calculates the effective address by adding 4 to the value in register X0. The address is not only used for the memory access, but is also written back to register X0. So, if we interpret the original value in X0 as a C pointer to an array of 32-bit data, we load the second value of the array and then increment the pointer by one, which is a four-byte increment in pointer arithmetic. Next, the instruction str w2, [x1, #4]! stores the 32 bits in W2 at the address obtained by adding 4 to the value in X1. It also writes the value incremented by 4 back to X1. The following two instructions ldr w2, [x0, #4]! and str w2, [x1, #4]! do the same with incremented values in X0 and X1.

Post-indexed: [base], #imm

Post-indexed instructions use the base address for the memory access, but also add an immediate offset to the value in the register that held the base address.

Listing 3.3.5 Implementation of the addressing_modes_4 function, which copies 2x32 bits from one memory location to another.#

    .section .text
    .type addressing_modes_4, %function
    .global addressing_modes_4
addressing_modes_4:
    ldr w2, [x0], #4
    str w2, [x1], #4
    ldr w2, [x0], #4
    str w2, [x1], #4
    ret

Post-indexed loads and stores are shown in Listing 3.3.5. The example is similar to the pre-indexed example in Listing 3.3.4. However, this time post-indexed loads and stores are used instead of pre-indexed ones. In the case of ldr w2, [x0], #4, this means that the instruction first loads the 32 bits from memory using the address in X0, and then increments the value in X0 by 4.

Literal (PC-relative): label

We can also use the value in the program counter as the base address, along with an immediate offset. For example, in the case of LDR (literal), the positive or negative immediate offset has a size of 19 bits and encoded multiples of 4. This results in a range of $-2^{19-1+2}$ to $2^{19-1+2}$ for the immediate. So we can have an offset from -1MiB to 1MiB relative to the program counter. In assembly code, we can use labels for the immediate offset so that the assembler will insert the correct numeric value for us.

Listing 3.3.6 Implementation of the function addressing_modes_5, which loads 32 bits from a PC-relative location and then writes them to memory.#

    .section .text
    .type addressing_modes_5, %function
    .global addressing_modes_5
addressing_modes_5:
    ldr w1, my_data
    str w1, [x0]
    ret

my_data:
    .word 128

The use of a PC-relative load is illustrated in Listing 3.3.6. In the case of ldr w1, my_data, the assembler would determine the immediate offset by comparing the location of the label my_data with that of the instruction. At runtime, the instruction then loads the 32 bits at the effective address obtained by adding the immediate offset to the value in the program counter. In this example, the instruction loads the value 128 to register W1.

3.4. Data Processing#

In addition to the load and store instructions, another large group of instructions are the data-processing instructions. These instructions read operands from up to two source registers, perform the computation, and write the result back to a destination register. The registers that an instruction reads from are called source registers. The registers an instruction writes to are called destination registers. When an instruction reads from and writes to a register, it is also referred to as a destination register in the corresponding A64 ISA instruction description. In addition to register data, some instructions use immediate values. Since the ISA contains many data-processing instructions, we will provide high-level descriptions of a few examples.

ADD (immediate): add x3, x8, #16

Add the unsigned immediate value of 16 to the value in source register X8 and write the result to destination register X3.

MOV (register): mov w0, w1

Copy the 32-bit value from source register W1 to destination register W0.

AND (shifted register): and x17, x8, x2, lsl #2

Perform a bitwise AND of the 64-bit value in source register X8 with the 64-bit value in source register X2 after it has been logically shifted to the left by 2. Write the result to destination register X17.

EOR (shifted register): eor w16, w16, w16

Perform a bitwise exclusive-OR of the 32-bit value in source register W16 with the 32-bit value in source register W16 and write the result to destination register W16. This effectively zeroes the 64-bit register X16, since the 32 upper bits are also implicitly set to zero.

MADD: madd x0, x1, x2, x3

Multiply the 64-bit values in source registers X1 and X2, add the intermediate result to the 64-bit value in source register X3, and write the final 64-bit result to destination register X0.

A special class of data-processing instructions sets the NZCV condition flags based on the result of the instruction. We call these instructions flag-setting instructions. The NZCV condition flags are defined as follows:

N

Negative condition flag. Set to 1 if the result of the last flag-setting instruction was negative.

Z

Zero condition flag. Set to 1 if the result of the last flag-setting instruction was zero, and to 0 otherwise. A result of zero often indicates an equal result from a comparison.

C

Carry condition flag. Set to 1 if the last flag-setting instruction resulted in a carry condition, for example an unsigned overflow on an addition.

V

Overflow condition flag. Set to 1 if the last flag-setting instruction resulted in an overflow condition, for example a signed overflow on an addition.

—Arm Limited: C5.2.11 of the Arm Architecture Reference Manual for A-profile architecture

Many flag-setting instructions can be distinguished from their “standard” counterparts by the s suffix, for example: ADDS (shifted register), ADDS (immediate), SUBS (shifted register), SUBS (immediate). An often-used special case is CMP, which exists in extended register, immediate, and shifted register variants. These instructions are aliases of their SUBS counterparts, where only the condition flags are set, but the actual result of the subtraction is discarded. For example, cmp x5, #16 is equivalent to subs xzr, x5, #16.