How To Store 8 Bit Register Values

ARM uses a load-store model for retentivity access which means that just load/shop (LDR and STR) instructions can access retentivity. While on x86 almost instructions are allowed to directly operate on information in memory, on ARM data must exist moved from memory into registers before beingness operated on. This ways that incrementing a 32-bit value at a detail memory accost on ARM would crave three types of instructions (load, increase, and store) to first load the value at a particular address into a annals, increment it within the annals, and store it back to the memory from the register.

To explicate the fundamentals of Load and Store operations on ARM, we offset with a basic example and go along with three basic start forms with three different accost modes for each commencement form. For each case we will utilise the same slice of associates code with a different LDR/STR start form, to keep it simple. The best way to follow this part of the tutorial is to run the code examples in a debugger (GDB) on your lab environment.

Start form: Immediate value as the offset
- Addressing fashion: Beginning
- Addressing mode: Pre-indexed
- Addressing mode: Mail-indexed
Start grade: Annals as the offset
- Addressing mode: Offset
- Addressing way: Pre-indexed
- Addressing mode: Post-indexed
Offset form: Scaled register equally the offset
- Addressing manner: Kickoff
- Addressing manner: Pre-indexed
- Addressing mode: Post-indexed

First basic example

Mostly, LDR is used to load something from memory into a register, and STR is used to store something from a register to a memory address.

LDR R2, [R0]   @ [R0] - origin address is the value found in R0. STR R2, [R1]   @ [R1] - destination address is the value found in R1.

LDR operation: loads thevalue at the address found in R0 to the destination register R2.

STR functioning: stores the value institute in R2 to the retentivity address found in R1.

This is how it would await like in a functional associates program:

.data          /* the .data section is dynamically created and its addresses cannot be hands predicted */ var1: .give-and-take 3  /* variable 1 in memory */ var2: .give-and-take four  /* variable 2 in memory */  .text          /* outset of the text (lawmaking) section */  .global _start  _start:     ldr r0, adr_var1  @ load the retentiveness accost of var1 via characterization adr_var1 into R0      ldr r1, adr_var2  @ load the memory address of var2 via label adr_var2 into R1      ldr r2, [r0]      @ load the value (0x03) at retentiveness address establish in R0 to register R2       str r2, [r1]      @ store the value found in R2 (0x03) to the memory address plant in R1      bkpt               adr_var1: .word var1  /* address to var1 stored here */ adr_var2: .word var2  /* accost to var2 stored here */

At the bottom nosotros have our Literal Pool (a memory expanse in the same code section to store constants, strings, or offsets that others can reference in a position-contained mode) where we store the retentivity addresses of var1 and var2 (defined in the data section at the top) using the labels adr_var1 and adr_var2. The first LDR loads the accost of var1 into register R0. The second LDR does the same for var2 and loads it to R1. And so we load the value stored at the memory address establish in R0 to R2, and store the value institute in R2 to the retentivity address found in R1.

When we load something into a register, the brackets ([ ]) mean: the value found in the register betwixt these brackets is a retentiveness address we desire to load something from.

When nosotros store something to a memory location, the brackets ([ ]) mean: the value found in the annals between these brackets is a retentivity address we want to store something to.

This sounds more complicated than it really is, so here is a visual representation of what's going on with the memory and the registers when executing the lawmaking above in a debugger:

Let'southward wait at the same lawmaking in a debugger.

                      gef>                    detach _start Dump of assembler lawmaking for function _start:  0x00008074 <+0>:      ldr  r0,          [pc, #12]          ; 0x8088 <adr_var1>  0x00008078 <+4>:      ldr  r1,          [pc, #12]          ; 0x808c <adr_var2>  0x0000807c <+viii>:      ldr  r2, [r0]  0x00008080 <+12>:     str  r2, [r1]  0x00008084 <+16>:     bx   lr End of assembler dump.

The labels we specified with the get-go ii LDR operations inverse to [pc, #12]. This is called PC-relative addressing. Because nosotros used labels, the compiler calculated the location of our values specified in the Literal Pool (PC+12). You can either summate the location yourself using this verbal approach, or y'all can use labels like we did previously. The only deviation is that instead of using labels, you need to count the exact position of your value in the Literal Pool. In this case, it is iii hops (four+4+four=12) abroad from the constructive PC position. More nigh PC-relative addressing later in this chapter.

Side annotation: In case you forgot why the constructive PC is located two instructions ahead of the current one, it is described in Office ii [… During execution, PC stores the address of the current educational activity plus 8 (two ARM instructions) in ARM state, and the current educational activity plus 4 (two Thumb instructions) in Thumb state. This is unlike from x86 where PC ever points to the next instruction to be executed…].

i.Offset form: Immediate value as the outset

STR    Ra, [Rb,          imm] LDR    Ra, [Rc,          imm]

Hither nosotros use an immediate (integer) every bit an get-go. This value is added or subtracted from the base annals (R1 in the example below) to access information at an commencement known at compile time.

.data var1: .word 3 var2: .word 4  .text .global _start  _start:     ldr r0, adr_var1  @ load the retentiveness address of var1 via label adr_var1 into R0     ldr r1, adr_var2  @ load the memory address of var2 via characterization adr_var2 into R1     ldr r2, [r0]      @ load the value (0x03) at retentiveness address establish in R0 to annals R2                      str r2, [r1, #2]                      @ address mode: offset. Store the value found in R2 (0x03) to the retentiveness accost found in          R1 plus 2. Base annals (R1) unmodified.                                                    str r2, [r1, #four]!                      @ address way: pre-indexed. Store the value found in R2 (0x03) to the retention accost found in          R1 plus 4. Base of operations register (R1) modified: R1 = R1+4                                    ldr r3, [r1]            , #four                    @ accost mode: post-indexed. Load the value at memory address found in R1 to annals          R3. Base of operations register (R1) modified: R1 = R1+4      bkpt  adr_var1: .word var1 adr_var2: .give-and-take var2

Let'south telephone call this program ldr.s, compile it and run it in GDB to see what happens.

$ equally ldr.s -o ldr.o $ ld ldr.o -o ldr $ gdb ldr

In GDB (with gef) we set a break point at _start and run the program.

                      gef>                    suspension _start                      gef>                    run ...                      global environment facility>                    nexti iii     /* to run the side by side three instructions */

The registers on my system are now filled with the post-obit values (continue in heed that these addresses might be different on your system):

$r0 :          0x00010098          -> 0x00000003 $r1 :          0x0001009c          -> 0x00000004 $r2 :          0x00000003          $r3 : 0x00000000 $r4 : 0x00000000 $r5 : 0x00000000 $r6 : 0x00000000 $r7 : 0x00000000 $r8 : 0x00000000 $r9 : 0x00000000 $r10 : 0x00000000 $r11 : 0x00000000 $r12 : 0x00000000 $sp : 0xbefff7e0 -> 0x00000001 $lr : 0x00000000 $pc : 0x00010080 -> <_start+12> str r2, [r1] $cpsr : 0x00000010

The side by side instruction that will be executed a STR operation with the offset address mode . Information technology will store the value from R2 (0x00000003) to the retentiveness address specified in R1 (0x0001009c) + the offset (#ii) = 0x1009e.

                      gef>                    nexti                      global environment facility>                      x/w 0x1009e  0x1009e <var2+ii>: 0x3

The next STR performance uses the pre-indexed address way . You can recognize this mode by the exclamation mark (!). The only difference is that the base of operations annals volition be updated with the final retentivity address in which the value of R2 will be stored. This means, we shop the value establish in R2 (0x3) to the memory address specified in R1 (0x1009c) + the showtime (#four) = 0x100A0, and update R1 with this exact address.

                      gef>                      nexti                          gef>                    x/west 0x100A0 0x100a0: 0x3                      gef>                    info register r1 r1          0x100a0          65696

The last LDR functioning uses the mail-indexed address way . This means that the base annals (R1) is used as the last address, so updated with the starting time calculated with R1+4. In other words, it takes the value plant in R1 (not R1+4), which is 0x100A0 and loads information technology into R3, then updates R1 to R1 (0x100A0) + get-go (#4) = 0x100a4.

                      gef>                    info register r1 r1          0x100a4          65700                      gef>                    info register r3 r3          0x3          3

Here is an abstract illustration of what'southward happening:

2.Commencement course: Register every bit the offset.

STR    Ra, [Rb,          Rc] LDR    Ra, [Rb,          Rc]

This offset form uses a register as an beginning. An instance usage of this offset form is when your code wants to access an assortment where the index is computed at run-time.

.data var1: .discussion iii var2: .word 4  .text .global _start  _start:     ldr r0, adr_var1  @ load the memory accost of var1 via characterization adr_var1 to R0      ldr r1, adr_var2  @ load the retentiveness address of var2 via label adr_var2 to R1      ldr r2, [r0]      @ load the value (0x03) at memory address found in R0 to R2                                    str r2, [r1, r2]                      @ address style: offset. Store the value found in R2 (0x03) to the memory address found in R1 with the offset R2 (0x03). Base of operations register unmodified.                                    str r2, [r1, r2]!                      @ address mode: pre-indexed. Store value found in R2 (0x03) to the memory address found in R1 with the starting time R2 (0x03). Base annals modified: R1 = R1+R2.                      ldr r3, [r1], r2                                @ address fashion: post-indexed. Load value at memory accost establish in R1 to register R3. Then change base register: R1 = R1+R2.     bx lr  adr_var1: .word var1 adr_var2: .word var2

Later on executing the kickoff STR operation with the starting time address mode , the value of R2 (0x00000003) will be stored at retention address 0x0001009c + 0x00000003 = 0x0001009F.

                      gef>                    ten/w 0x0001009F  0x1009f <var2+three>: 0x00000003

The second STR operation with the pre-indexed address way will do the same, with the difference that information technology will update the base of operations annals (R1) with the calculated retention address (R1+R2).

                      gef>                    info register r1  r10x1009f          65695

The last LDR functioning uses the mail service-indexed address mode and loads the value at the memory accost found in R1 into the register R2, then updates the base of operations register R1 (R1+R2 = 0x1009f + 0x3 = 0x100a2).

                      gef>                    info register r1  r1          0x100a2          65698                      gef>                    info register r3  r30x3          3

3.Get-go course: Scaled annals as the kickoff

LDR    Ra, [Rb,          Rc, <shifter>] STR    Ra, [Rb,          Rc, <shifter>]

The tertiary offset course has a scaled register as the beginning. In this case, Rb is the base register and Rc is an immediate offset (or a register containing an immediate value) left/correct shifted (<shifter>) to scale the immediate. This ways that the barrel shifter is used to scale the offset. An case usage of this start form would exist for loops to iterate over an array. Here is a elementary example yous can run in GDB:

.data var1: .word three var2: .give-and-take four  .text .global _start  _start:     ldr r0, adr_var1         @ load the retentiveness address of var1 via label adr_var1 to R0     ldr r1, adr_var2         @ load the memory address of var2 via label adr_var2 to R1     ldr r2, [r0]             @ load the value (0x03) at retentivity address found in R0 to R2                      str r2, [r1, r2, LSL#two]                                @ address style: starting time. Shop the value found in R2 (0x03) to the retentivity address institute in R1 with the starting time R2 left-shifted by 2. Base of operations register (R1) unmodified.                      str r2, [r1, r2, LSL#two]!                      @ accost mode: pre-indexed. Shop the value found in R2 (0x03) to the retention address found in R1 with the start R2 left-shifted by 2. Base annals modified: R1 = R1 + R2<<two                                    ldr r3, [r1], r2, LSL#2                                @ address mode: post-indexed. Load value at memory address found in R1 to the register R3. Then modifiy base annals: R1 = R1 + R2<<2     bkpt  adr_var1: .word var1 adr_var2: .word var2

The commencement STR performance uses the offset address mode and stores the value found in R2 at the memory location calculated from [r1, r2, LSL#2], which means that it takes the value in R1 equally a base of operations (in this case, R1 contains the memory address of var2), then it takes the value in R2 (0x3), and shifts it left by 2. The motion-picture show beneath is an endeavor to visualize how the memory location is calculated with [r1, r2, LSL#2].

The second STR operation uses the pre-indexed address mode . This means, information technology performs the same action as the previous operation, with the difference that it updates the base register R1 with the calculated memory address afterwards. In other words, information technology will kickoff store the value establish at the memory address R1 (0x1009c) + the offset left shifted by #two (0x03 LSL#two = 0xC) = 0x100a8, and update R1 with 0x100a8.

                      gef>                    info annals r1 r1           0x100a8          65704

The last LDR operation uses the post-indexed address mode . This ways, it loads the value at the memory address found in R1 (0x100a8) into register R3, then updates the base register R1 with the value calculated with r2, LSL#2. In other words, R1 gets updated with the value R1 (0x100a8) + the first R2 (0x3) left shifted past #ii (0xC) = 0x100b4.

                      gef>                    info register r1 r10x100b4          65716

Summary

Remember the three offset modes in LDR/STR:

outset fashion uses an immediate as offset
- ldr r3, [r1, #4]
first mode uses a register as outset
- ldr r3, [r1, r2]
offset mode uses a scaled register equally beginning
- ldr r3, [r1, r2, LSL#2]

How to remember the dissimilar address modes in LDR/STR:

If in that location is a !, it'southward prefix address manner
- ldr r3, [r1, #4]!
- ldr r3, [r1, r2]!
- ldr r3, [r1, r2, LSL#two]!
If the base register is in brackets by itself, information technology's postfix address mode
- ldr r3, [r1], #4
- ldr r3, [r1], r2
- ldr r3, [r1], r2, LSL#two
Anything else is offset address mode.
- ldr r3, [r1, #4]
- ldr r3, [r1, r2]
- ldr r3, [r1, r2, LSL#2]

LDR is not only used to load information from memory into a annals. Sometimes you will come across syntax like this:

.section .text .global _start  _start:    ldr r0, =jump        /* load the address of the function label bound into R0 */    ldr r1, =0x68DB00AD  /* load the value 0x68DB00AD into R1 */ jump:    ldr r2, =511         /* load the value 511 into R2 */     bkpt

These instructions are technically chosen pseudo-instructions. We tin can use this syntax to reference data in the literal pool. The literal puddle is a retentiveness area in the same section (because the literal pool is part of the lawmaking) to store constants, strings, or offsets. In the case above nosotros use these pseudo-instructions to reference an offset to a function, and to move a 32-fleck abiding into a register in 1 pedagogy. The reason why we sometimes need to employ this syntax to motion a 32-bit constant into a register in one education is because ARM can only load a 8-flake value in one get. What? To understand why, yous need to know how immediate values are existence handled on ARM.

Loading immediate values in a register on ARM is non every bit straightforward equally it is on x86. There are restrictions on which immediate values you can employ. What these restrictions are and how to deal with them isn't the virtually exciting part of ARM assembly, simply bear with me, this is but for your understanding and in that location are tricks you tin can use to bypass these restrictions (hint: LDR).

Nosotros know that each ARM instruction is 32bit long, and all instructions are conditional. At that place are 16 condition codes which we tin can use and 1 status lawmaking takes upwardly iv bits of the instruction. And then we need 2 $.25 for the destination register. two bits for the first operand register, and ane bit for the set-status flag, plus an assorted number of bits for other matters like the actual opcodes. The bespeak here is, that afterward assigning bits to didactics-blazon, registers, and other fields, there are just 12 bits left for firsthand values, which will only allow for 4096 different values.

This ways that the ARM instruction is only able to use a limited range of immediate values with MOV straight. If a number can't be used directly, information technology must be carve up into parts and pieced together from multiple smaller numbers.

Simply at that place is more. Instead of taking the 12 bits for a single integer, those 12 bits are split into an 8bit number (n) being able to load any 8-bit value in the range of 0-255, and a 4bit rotation field (r) being a correct rotate in steps of 2 between 0 and 30. This means that the full immediate value v is given by the formula: 5 = n ror 2*r. In other words, the merely valid firsthand values are rotated bytes (values that tin can be reduced to a byte rotated by an even number).

Here are some examples of valid and invalid immediate values:

Valid values: #256        // 1 ror 24 --> 256 #384        // half-dozen ror 26 --> 384 #484        // 121 ror xxx --> 484 #16384      // ane ror eighteen --> 16384 #2030043136 // 121 ror viii --> 2030043136 #0x06000000 // 6 ror viii --> 100663296 (0x06000000 in hex)  Invalid values: #370        // 185 ror          31 -->                      31 is non in range (0 – 30)          #511        // ane 1111 1111          --> chip-pattern can't fit into 1 byte #0x06010000 // 1 1000 0001.. --> bit-pattern can't fit into one byte

This has the consequence that it is non possible to load a full 32bit accost in i go. We can bypass this restrictions by using one of the post-obit two options:

Construct a larger value out of smaller parts
1. Instead of using MOV r0, #511
2. Split 511 into two parts: MOV r0, #256, and ADD r0, #255
Use a load construct 'ldr r1,=value' which the assembler will happily catechumen into a MOV, or a PC-relative load if that is not possible.
1. LDR r1, =511

If you try to load an invalid firsthand value the assembler volition complain and output an fault saying: Error: invalid constant. If you encounter this mistake, you at present know what it ways and what to do about it.
Let's say you desire to load #511 into R0.

.section .text .global _start  _start:     mov     r0, #511     bkpt

If you try to assemble this code, the assembler volition throw an fault:

azeria@labs:~$ equally test.south -o examination.o test.s: Assembler letters: test.s:five: Error: invalid constant (1ff) later on fixup

Y'all need to either split 511 in multiple parts or you use LDR as I described before.

.department .text .global _start  _start:  mov r0, #256   /* 1 ror 24 = 256, and then it's valid */  add r0, #255   /* 255 ror 0 = 255, valid. r0 = 256 + 255 = 511 */  ldr r1, =511   /* load 511 from the literal pool using LDR */  bkpt

If y'all need to figure out if a certain number can be used as a valid immediate value, y'all don't demand to calculate information technology yourself. You can use my fiddling python script chosen rotator.py which takes your number as an input and tells y'all if information technology tin can exist used as a valid immediate number.

azeria@labs:~$ python rotator.py Enter the value you want to check: 511  Lamentable, 511 cannot be used as an immediate number and has to be split.  azeria@labs:~$ python rotator.py Enter the value y'all want to check: 256  The number 256 tin exist used equally a valid immediate number. 1 ror 24 --> 256