EECS 373

Design of Microprocessor-Based Systems

Prabal Dutta
University of Michigan

Instruction Set Architecture

Assembly Language Programming
Software Development Toolchain
Application Binary Interface (ABI)

Slides developed in part by

Mark Brehob 1
This week…

Finish ARM assembly example from last time

Walk though of the ARM ISA

Software Development Tool Flow

Application Binary Interface (ABI)

2
Assembly example

data:
.byte 0x12, 20, 0x20, -1
func:
mov r0, #0
mov r4, #0
movw r1, #:lower16:data
movt r1, #:upper16:data
top: ldrb r2, [r1],#1
add r4, r4, r2
add r0, r0, #1
cmp r0, #4
bne top

3
Assembly example

data:
.byte 0x12, 20, 0x20, -1
func:
mov r0, #0
mov r4, #0
movw r1, #:lower16:data
movt r1, #:upper16:data
top: ldrb r2, [r1],#1
add r4, r4, r2
add r0, r0, #1
cmp r0, #4
bne top

4
Instructions used

• mov
– Moves data from register or immediate.
– Or also from shifted register or immediate!
• the mov assembly instruction maps to a
bunch of different encodings!
– If immediate it might be a 16-bit or 32-bit
instruction
• Not all values possible
• why?
• movw
– Actually an alias to mov
• “w” is “wide”
• hints at 16-bit immediate

5
From the ARMv7-M Architecture Reference
Manual
(posted on the website under references)

There are similar entries for

move immediate, move shifted
(which actually maps to different
instructions) etc.

6
Directives

• #:lower16:data
– What does that do?
– Why?

• Note:
– “data” is a label for a memory address!

7
8
Loads!

• ldrb -- Load register byte

– Note this takes an 8-bit value and moves it into a
32-bit location!
• Zeros out the top 24 bits

• ldrsb -- Load register signed byte

– Note this also takes an 8-bit value and moves it
into a 32-bit location!
• Uses sign extension for the top 24 bits

9
Addressing Modes

• Offset Addressing
– Offset is added or subtracted from base register
– Result used as effective address for memory access
– [<Rn>, <offset>]
• Pre-indexed Addressing
– Offset is applied to base register
– Result used as effective address for memory access
– Result written back into base register
– [<Rn>, <offset>]!
• Post-indexed Addressing
– The address from the base register is used as the EA
– The offset is applied to the base and then written
back
– [<Rn>], <offset>
So what does the program _do_?

data:
.byte 0x12, 20, 0x20, -1
func:
mov r0, #0
mov r4, #0
movw r1, #:lower16:data
movt r1, #:upper16:data
top: ldrb r2, [r1],#1
add r4, r4, r2
add r0, r0, #1
cmp r0, #4
bne top

11
This Week…

Finish ARM assembly example from last time

Walk though of the ARM ISA

Software Development Tool Flow

Application Binary Interface (ABI)

12
An ISA defines the hardware/software interface

• A “contract” between architects and programmers

• Register set
• Instruction set
– Addressing modes
– Word size
– Data formats
– Operating modes
– Condition codes
• Calling conventions
– Really not part of the ISA (usually)
– Rather part of the ABI
– But the ISA often provides meaningful support.

13
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

14
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

16
Word Size

• Perhaps most defining feature of an architecture

– IA-32 (Intel Architecture, 32-bit)
• Word size is what we’re referring to when we say
– 8-bit, 16-bit, 32-bit, or 64-bit machine, microcontroller,
microprocessor, or computer
• Determines the size of the addressable memory
– A 32-bit machine can address 2^32 bytes
– 2^32 bytes = 4,294,967,296 bytes = 4GB
– Note: just because you can address it doesn’t mean
that there’s actually something there!
• In embedded systems, tension between 8/16/32
bits
– Code density/size/expressiveness
– CPU performance/addressable memory
Word Size  32-bit ARM Architecture

• ARM’s Thumb-2 adds 32-bit instructions to 16-bit

ISA
• Balance between 16-bit density and 32-bit
performance

373 Focus
A quick comment on the ISA:
From: ARMv7-M Architecture Reference Manual

19
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

20
ARM Cortex-M3 Registers

• R0-R12
– General-purpose registers
– Some 16-bit (Thumb)
instruction only access R0-
R7
• R13 (SP, PSP, MSP)
– Stack pointer(s)
– More details on next slide
• R14 (LR)
– Link Register
– When a subroutine is called,
return address kept in LR
• R15 (PC)
– Holds the currently
executing program address
– Can be written to control
program flow
21
ARM Cortex-M3 Registers

Note: there are two stack pointers!

SP_process (PSP) SP_main (MSP)
used by: used by:
-Base app code -OS kernel
(when not running -Exception handlers
an exception -App code w/
handler) privileded access

Mode dependent

22
ARM Cortex-M3 Registers

• xPSR
– Program Status Register
– Provides arithmetic and logic processing flags
– We’ll return to these later today

• PRIMASK, FAULTMASK, BASEPRI

– Interrupt mask registers
– PRIMASK: disable all interrupts except NMI and hard fault
– FAULTMASK: disable all interrupts except NMI
– BASEPRI: Disable all interrupts of specific priority level or
lower
– We’ll return to these during the interrupt lectures

• CONTROL
– Control register
– Define priviledged status and stack pointer selection
23
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

24
ARM Cortex-M3 Address Space / Memory Map

25
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

26
The endianess religious war: 289 years and
counting!
• Modern version • Little-Endian
– Danny Cohen – LSB is at lower address
– IEEE Computer, v14, #10 Memory Value
Offset (LSB)
(MSB)
– Published in 1981 ======
===========
– Satire on CS religious war uint8_t
00
a = 1; 0x0000 01 02 FF

uint8_t b = 2;
uint16_t c = 255; // 0x00FF
uint32_t d = 0x12345678; 0x0004 78 56 34
• Historical Inspiration • Big-Endian
12

– Jonathan Swift – MSB is at lower

– Gulliver's Travels address Memory Value
Offset (LSB)
– Published in 1726 (MSB)
======
===========
– Satire on Henry-VIII’s splituint8_t a = 1; 0x0000 01 02 00
FF
with the Church uint8_t b = 2;
uint16_t c = 255; // 0x00FF
• Now a major motion uint32_t d = 0x12345678; 0x0004 12 34 56
picture! 78
27
Addressing: Big Endian vs Little Endian (370
slide)
• Endian-ness: ordering of bytes within a
word
– Little - increasing numeric significance with
increasing memory addresses
– Big – The opposite, most significant byte first
– MIPS is big endian, x86 is little endian
ARM Cortex-M3 Memory Formats (Endian)

• Default memory format for ARM CPUs: LITTLE ENDIAN

• Bytes 0-3 hold the first stored word
• Bytes 4-7 hold the second stored word
• Processor contains a configuration pin BIGEND
– Enables hardware system developer to select format:
• Little Endian
• Big Endian (BE-8)
– Pin is sampled on reset
– Cannot change endianness when out of reset

• Source: [ARM TRM] ARM DDI 0337E, “Cortex-M3

Technical Reference Manual,” Revision r1p1, pg 67
(2-11).
29
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

30
Instruction encoding
• Instructions are encoded in machine language
opcodes
• Sometimes
– Necessary to hand generate opcodes
– Necessary to verify assembled code is correct
• How? Refer to the “ARM ARM”
Instruction Register Value Memory
s Value
movs r0, 001|00|000|00001010 (LSB)
#10 (MSB)
(msb) (lsb) 0a 20 00
movs r1, #0 21
001|00|001|00000000
ARMv7
ARM
Instruction Encoding
ADD immediate

32
33
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

34
Addressing Modes

• Offset Addressing
– Offset is added or subtracted from base register
– Result used as effective address for memory access
– [<Rn>, <offset>]
• Pre-indexed Addressing
– Offset is applied to base register
– Result used as effective address for memory access
– Result written back into base register
– [<Rn>, <offset>]!
• Post-indexed Addressing
– The address from the base register is used as the EA
– The offset is applied to the base and then written
back
– [<Rn>], <offset>
<offset> options

• An immediate constant
– #10

• An index register
– <Rm>

• A shifted index register

– <Rm>, LSL #<shift>

• Lots of weird options…

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

37
Branch

38
Branch examples

• b target
– Branch without link (i.e. no possibility of return) to target
– The PC is not saved!
• bl func
– Branch with link (call) to function func
– Store the return address in the link register (lr)
• bx lr
– Use to return from a function
– Moves the lr value into the pc
– Could be a different register than lr as well
• blx reg
– Branch to address specified by reg
– Save return address in lr
– When using blx, makre sure lsb of reg is 1 (otherwise, the
CPU will fault b/c it’s an attempt to go into the ARM state) 39
Branch examples (2)

• blx label
– Branch with link and exchange state. With
immediate data, blx changes to ARM state. But
since CM-3 does not support ARM state, this
instruction causes a fault!
• mov r15, r0
– Branch to the address contained in r0
• ldr r15, [r0]
– Branch to the to address in memory specified by
r0

• Calling bl overwrites contents of lr!

– So, save lr if your function needs to call a
function!

40
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

41
Data processing instructions

Many, Many More!

42
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

43
Load/Store instructions

44
Miscellaneous instructions

45
ARMv7-M Architect
ure Reference Manual
ARMv7-M_ARM.pdf
46
Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing
modes)
32-bits 32-bits

mov r0, #4

ldr r1,
[r0,#8]
r1=mem((r0)+8)

bne loop

subs r2, #1
Endianess Endianess

47
Application Program Status Register (APSR)

48
Updating the APSR

• SUB Rx, Ry
– Rx = Rx - Ry
– APSR unchanged
• SUBS
– Rx = Rx - Ry
– APSR N, Z, C, V updated
• ADD Rx, Ry
– Rx = Rx + Ry
– APSR unchanged
• ADDS
– Rx = Rx + Ry
– APSR N, Z, C, V updated

49
Conditional execution:
Append to many instructions for conditional
execution

51
IT blocks

• Conditional execution in C-M3 done in “IT”

block
• IT [T|E]*3
• More on this later…

52
Conditional Execution on the ARM

• ARM instruction can include conditional suffixes, e.g.

– EQ, NE, GE, LT, GT, LE, …
• Normally, such suffixes are used for branching (BNE)
• However, other instructions can be conditionally
executed
– They must be inside of an IF-THEN block
– When placed inside an IF-THEN block
• Conditional execution (EQ, NE, GE,… suffix) and
• Status register update (S suffix) can be used together
– Conditional instructions use a special “IF-THEN” or “IT” block
• IT (IF-THEN) blocks
– Support conditional execution (e.g. ADDNE)
– Without a branch penalty (e.g. BNE)
– For no more than a few instructions (i.e. 1-4)

53
Conditional Execution using IT Instructions

• In an IT block
– Typically an instruction that updates the status register is
exec’ed
– Then, the first line of an IT instruction follows (of the form
ITxyz)
• Where each x, y, and z is replaced with “T”, “E”, or
nothing (“”)
• T’s must be first, then E’s (between 1 and 4 T’s and E’s in
total)
• Ex: IT,
IT<x><y><z> ITT, ITE, ITTT, ITTE, ITEE,
<cond> ITTTT,
; IT ITTTE, (<x>,
instruction ITTEE, ITEEE
<y>,
– Followed by 1-4 conditional instructions
; <z> can be “T”, “E” or
“”) • where # of conditional instruction equals total # of T’s &
instr1<cond> <operands> ; 1st instruction
E’s
(<cond>
; must be same as IT)
instr2<cond or not cond> <operands> ; 2nd instruction (can be
; <cond> or <!cond>
instr3<cond or not cond> <operands> ; 3rd instruction (can be
; <cond> or <!cond>
Source: Joseph Yiu, “The Definitive Guide to the ARM Cortex-M3”, 2 nd Ed., Newnes/Elsevier, © 2010.
54
Example of Conditional Execution using IT
Instructions

CMP r1, r2 ; if r1 < r2 (less than, or LT)

ITTEE LT ; then execute 1st & 2nd instruction
; (indicated by 2 T’s)
; else execute 3rd and 4th instruction
; (indicated by 2 E’s)
SUBLT r2, r1 ; 1st instruction
LSRLT r2, #1 ; 2nd instruction
SUBGE r1, r2 ; 3rd instruction (GE opposite of
LT)
LSRGE r1, #1 ; 4th instruction (GE opposite of
LT)
IT<x><y><z> <cond> ; IT instruction (<x>, <y>,
; <z> can be “T”, “E” or “”)
instr1<cond> <operands> ; 1st instruction
(<cond>
; must be same as IT)
instr2<cond or not cond> <operands> ; 2nd instruction (can be
; <cond> or <!cond>
instr3<cond or not cond> <operands> ; 3rd instruction (can be
; <cond> or <!cond>
instr4<cond or not cond> <operands> ; 4th instruction (can be
; <cond> or <!cond>
Source: Joseph Yiu, “The Definitive Guide to the ARM Cortex-M3”, 2 nd Ed., Newnes/Elsevier, © 2010.
55
The ARM architecture “books” for this class

56
Exercise:
What is the value of r2 at done?

...
start:
movs r0, #1
movs r1, #1
movs r2, #1
sub r0, r1
bne done
movs r2, #2
done:
b done
...

57
Solution:
What is the value of r2 at done?

...
start:
movs r0, #1 // r0  1, Z=0
movs r1, #1 // r1  1, Z=0
movs r2, #1 // r2  1, Z=0
sub r0, r1 // r0  r0-r1
// but Z flag
untouched
// since sub vs subs
bne done // NE true when Z==0
// So, take the
branch
movs r2, #2 // not executed
done:
b done // r2 is still 1 58
Today…

Finish ARM assembly example from last time

Walk though of the ARM ISA

Software Development Tool Flow

Application Binary Interface (ABI)

59
The ARM software tools “books” for this class

60
How does an assembly language program
get turned into an executable program image?
Binary
program
file (.bin)

Assembly Object
Executable
files (.s) files (.o) y
image file p
jco
ld ob
(linker) ob
as
jd
(assembler) um
p

Memor
Memor
y
y
layou
layou
t
t
Disassembled
Linker code (.lst)
script (.ld)

61
 What are the real GNU executable names for the
ARM?
• Just add the prefix “arm-none-eabi-” prefix
• Assembler (as)
– arm-none-eabi-as
• Linker (ld)
– arm-none-eabi-ld
• Object copy (objcopy)
– arm-none-eabi-objcopy
• Object dump (objdump)
– arm-none-eabi-objdump
• C Compiler (gcc)
– arm-none-eabi-gcc
• C++ Compiler (g++)
– arm-none-eabi-g++
Tools Tutorial: The GNU Linker
http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf 62
 Real-world example

• To the terminal! Example code online:

https://github.com/brghena/eecs373_toolchain_examples)
• First, get the code. Open a shell and type:
$ git clone https://github.com/brghena/eecs373_toolchain_examples
• Next, find the example and look at the Makefile
and .s
$ cd eecs373_toolchain_examples/example
$ cat Makefile
$ cat example.s
• Assemble the code* and look at the .lst, .o, .out files
$ make
$ cat example.lst
$ hexdump example.o
$ hexdump example.out
You’ll need to have the tools installed. Two useful links:
ttps://launchpad.net/gcc-arm-embedded/+download
ttp://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf
63
How are assembly files assembled?

• $ arm-none-eabi-as
– Useful options
• -mcpu
• -mthumb
• -o

$ arm-none-eabi-as -mcpu=cortex-m3 -mthumb example1.s -o example1.o

64
A simple Makefile example

Target
Dependencies

example.bin : example.o
arm-none-eabi-ld example.o -Ttext 0x0 -o example.out
arm-none-eabi-objdump -S example.out > example.lst
arm-none-eabi-objcopy -Obinary example.out example.bin

example.o : example.s
arm-none-eabi-as example.s -o example.o

clean :
rm -f *.o
rm -f *.out Actions
rm -f *.bin
rm -f *.lst

65
A “real” ARM assembly language program for
GNU
.equ STACK_TOP, 0x20000800
.text
.syntax unified
.thumb
.global _start
.type start, %function

_start:
.word STACK_TOP, start
start:
movs r0, #10
movs r1, #0
loop:
adds r1, r0
subs r0, #1
bne loop
deadloop:
b deadloop
.end

66
What’s it all mean?

.equ STACK_TOP, 0x20000800 /* Equates symbol to value */

.text /* Tells AS to assemble region
*/
.syntax unified /* Means language is ARM UAL */
.thumb /* Means ARM ISA is Thumb */
.global _start /* .global exposes symbol */
/* _start label is the beginning
*/
/* ...of the program region */
.type start, %function /* Specifies start is a
function */
/* start label is reset handler
*/
_start:
.word STACK_TOP, start /* Inserts word
0x20000800 */
/* Inserts word (start) */
start:
movs r0, #10 /* We’ve seen the rest ... */
movs r1, #0
loop:
adds r1, r0
subs r0, #1
bne loop 67
What information does the disassembled file
provide?
all:
arm-none-eabi-as -mcpu=cortex-m3 -mthumb example1.s -o
example1.o
arm-none-eabi-ld -Ttext 0x0 -o example1.out example1.o
arm-none-eabi-objcopy -Obinary example1.out example1.bin
arm-none-eabi-objdump -S example1.out > example1.lst

.equ STACK_TOP, 0x20000800 example1.out: file format elf32-

littlearm
.text
.syntax unified
.thumb Disassembly of section .text:
.global _start
.type start, %function 00000000 <_start>:
0: 20000800 .word 0x20000800
_start: 4: 00000009 .word 0x00000009
.word STACK_TOP, start
start: 00000008 <start>:
movs r0, #10 8: 200a movs
movs r1, #0 r0, #10
loop: a: 2100 movs
adds r1, r0 r1, #0
subs r0, #1
bne loop 0000000c <loop>:
deadloop: c: 1809 adds
b deadloop r1, r1, r0
.end e: 3801 subs
r0, #1
10: d1fc bne.n c
<loop>
68
 Linker script that puts all the code in the right
places
OUTPUT_FORMAT("elf32-littlearm") • Specifies little-endian arm in ELF
OUTPUT_ARCH(arm) format
ENTRY(main) • Specifies ARM CPU
• Start executing at label named “main
MEMORY
”
{
/* SmartFusion internal eSRAM */
ram (rwx) : ORIGIN = 0x20000000, LENGTH = 64k• We have 64k of memory starting at
} 0x20000000. You can read, write and
execute out of it. We named it “ram”
SECTIONS
{
.text : • “.” is a reference to the current
{ memory location
. = ALIGN(4); • First align to a word (4 byte) boundary
*(.text*)
• Place all sections that include .text at
. = ALIGN(4);
_etext = .; the start (* here is a wildcard)
} >ram • Define a label named _etext to be the
} current address.
end = .; • Put it all in the memory location
defined by the ram symbol’s location.

More info: The GNU Linker

http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf
69
How does a mixed C/Assembly program
get turned into a executable program image?
C files (.c)

Binary
program
ld file (.bin)
(linker)

Assembly Object
Executable
files (.s) files (.o) y
image file p
jco
gcc ob
(compile
as + link) ob
jd
(assembler) um
p

Memor
Memor
y
y
layou
layou
t
t
Disassembled
Code (.lst)
Library Linker
object script (.ld) 70
 Real-world example: Mixing C and assembly code

• To the terminal again! Example code online:

https://github.com/brghena/eecs373_toolchain_examples
$ git clone https://github.com/brghena/eecs373_toolchain_examples

• Inline assembly
$ cd eecs373_toolchain_examples/inline_asm
$ cat cfile.c

• Separate C and assembly

$ cd eecs373_toolchain_examples/inline_asm
$ cat asmfile.s
$ cat cfile.c

You’ll need to have the tools installed. Two useful links:

ttps://launchpad.net/gcc-arm-embedded/+download
ttp://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf
71
Today…

Finish ARM assembly example from last time

Walk though of the ARM ISA

Software Development Tool Flow

Application Binary Interface (ABI)

72
When is this relevant?

• The ABI establishes caller/callee responsibilities

– Who saves which registers
– How function parameters are passed
– How return values are passed back

• The ABI is a contract with the compiler

– All assembled C code will follow this standard

• You need to follow it if you want C and Assembly

to work together correctly

• What if you hand write everything in Assembly?

– Maybe less important. Unless you’re ever going to extend
the code so others can use it

73
From the Procedure Call Standard

Source: Procedure Call Standard for the ARM Architecture

http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/ARM-AAPCS-EABI-v2.08.pdf
74
ABI Basic Rules

1. A subroutine must preserve the contents of

the registers r4-11 and SP
– These are the callee save registers
– Let’s be careful with r9 though
2. Arguments are passed though r0 to r3
– These are the caller save registers
– If we need more arguments, we put a pointer into
memory in one of the registers
• We’ll worry about that later
3. Return value is placed in r0
– r0 and r1 if 64-bits
4. Allocate space on stack as needed. Use it as
needed. Put it back when done…
– Keep things word aligned*

75
Let’s write a simple ABI routine

• int bob(int a, int b)

– returns a2 + b2
• Instructions you might need
– add adds two values
– mul multiplies two values
– bx branch to register

Other useful facts

• Stack grows down.
– And pointed to by “sp”
• Return address is held in “lr”

76
Questions?

Comments?

Discussion?

77