{"id":105265,"date":"2021-05-31T07:00:00","date_gmt":"2021-05-31T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=105265"},"modified":"2021-06-01T08:35:26","modified_gmt":"2021-06-01T15:35:26","slug":"20210531-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20210531-00\/?p=105265","title":{"rendered":"The ARM processor (Thumb-2), part 1: Introduction"},"content":{"rendered":"

I’ve run out of historical processors that Windows supported, so I’m moving on to processors that are still in support. First up in this series is 32-bit ARM.<\/p>\n

As with all of these series, I’m focusing on how Windows 10\u00b9 uses the processor in user mode, with particular focus on the instructions you are most likely to encounter in compiler-generated code.<\/p>\n

The classic ARM processor generally follows the principles of Reduced Instruction Set Computing (RISC): It has fixed-length instructions, a large uniform register set, and the only operations on memory are loading and storing. However, Windows doesn’t use the ARM processor in classic mode, so some of the above statements aren’t true any more.<\/p>\n

Windows uses the ARM in a mode known as Thumb-2 mode.\u00b2 In Thumb-2 mode, some classic features are not available, such as most forms of predication. The Thumb-2 mode instruction encoding is variable-length, with a mix of 16-bit instructions and 32-bit instructions. Every instruction is required to begin on an even address, but 32-bit instructions are permitted to straddle a 4-byte boundary.<\/p>\n

In addition to classic ARM mode, Thumb mode, and Thumb-2 mode, there are also Jazelle<\/a> mode (which executes Java bytecode) and ThumbEE mode. I’m not going to cover them at all in this series, since Windows doesn’t use them. From now on, I’m talking only about Thumb-2 mode<\/b>.<\/p>\n

The ARM architecture permits little-endian or big-endian operation. Windows runs the processor in little-endian mode and disables the SETEND<\/code> instruction, so you can’t switch to big-endian even if you tried.<\/p>\n

The architectural terms for data sizes are<\/p>\n\n\n\n\n\n\n\n
Term<\/th>\nSize<\/th>\n<\/tr>\n
byte<\/td>\n\u20078 bits<\/td>\n<\/tr>\n
halfword<\/td>\n16 bits<\/td>\n<\/tr>\n
word<\/td>\n32 bits<\/td>\n<\/tr>\n
doubleword<\/td>\n64 bits<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The ARM instruction set has 16 general-purpose integer registers, each 32 bits wide, and formally named r0<\/var> through r15<\/var>. They are conventionally used as follows:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Register<\/th>\nMnemonic<\/th>\nMeaning<\/th>\nPreserved?<\/th>\n<\/tr>\n
r0<\/var><\/td>\n(a1<\/var>)<\/td>\nargument 1 and return value<\/td>\nNo<\/td>\n<\/tr>\n
r1<\/var><\/td>\n(a2<\/var>)<\/td>\nargument 2 and second return value<\/td>\nNo<\/td>\n<\/tr>\n
r2<\/var><\/td>\n(a3<\/var>)<\/td>\nargument 3<\/td>\nNo<\/td>\n<\/tr>\n
r3<\/var><\/td>\n(a4<\/var>)<\/td>\nargument 4<\/td>\nNo<\/td>\n<\/tr>\n
r4<\/var><\/td>\n(v1<\/var>)<\/td>\n <\/td>\nYes<\/td>\n<\/tr>\n
r5<\/var><\/td>\n(v2<\/var>)<\/td>\n <\/td>\nYes<\/td>\n<\/tr>\n
r6<\/var><\/td>\n(v3<\/var>)<\/td>\n <\/td>\nYes<\/td>\n<\/tr>\n
r7<\/var><\/td>\n(v4<\/var>)<\/td>\n <\/td>\nYes<\/td>\n<\/tr>\n
r8<\/var><\/td>\n(v5<\/var>)<\/td>\n <\/td>\nYes<\/td>\n<\/tr>\n
r9<\/var><\/td>\n(v6<\/var>)<\/td>\n <\/td>\nYes<\/td>\n<\/tr>\n
r10<\/var><\/td>\n(v7<\/var>)<\/td>\n <\/td>\nYes<\/td>\n<\/tr>\n
r11<\/var><\/td>\nfp<\/var> (v8<\/var>)<\/td>\nframe pointer<\/td>\nYes<\/td>\n<\/tr>\n
r12<\/var><\/td>\n(ip<\/var>)<\/td>\nintraprocedure call scratch<\/td>\nVolatile<\/td>\n<\/tr>\n
r13<\/var><\/td>\nsp<\/var><\/td>\nstack pointer<\/td>\nYes<\/td>\n<\/tr>\n
r14<\/var><\/td>\nlr<\/var><\/td>\nlink register<\/td>\nNo<\/td>\n<\/tr>\n
r15<\/var><\/td>\npc<\/var><\/td>\nprogram counter<\/td>\nN\/A<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The names in parentheses are used by some assemblers, but Microsoft’s toolchain doesn’t use those names. Some operating systems use r9<\/var> for special purposes (usually as a table of contents\/gp or a thread-local pointer), but Windows does not assign it any special meaning. On Windows, it is available for general use, as long as the value is preserved across calls.<\/p>\n

The meanings of the last three registers (sp<\/var>, lr<\/var>, pc<\/var>) are architectural.\u00b3 The rest are convention. We’ll learn more about register conventions later.<\/p>\n

The processor enforces 4-byte alignment for the sp<\/var> register. Operations which misalign the stack result in unpredictable behavior.\u2074 Windows requires further that the stack be 8-byte aligned at function call boundaries.<\/p>\n

The ARM is notable for putting the program counter in the general-purpose register category, a feature which has been called “overly uniform<\/a>” by noted processor architect Mitch Alsup<\/a>. The program counter register reads as the address of the current instruction plus four: The +4 is due to the pipelining of the original ARM implementation: By the time the pipeline gets to fetching the value of the register, the CPU has already advanced the instruction pointer four bytes. Even though later implementations of ARM have deeper pipelining, they continue to emulate the original pipelining for the purpose of reading from the program counter.\u2075 Writing to the program counter acts like a jump instruction:\u00a0The next instruction to be executed is the one at the address you wrote.<\/p>\n

This magic treatment of the program counter register is a bit mind-blowing when you first encounter it.<\/p>\n

Floating point and SIMD support (Neon) is optional in the ARM architecture, but Windows requires both. This means that you also have 32 double-precision (64-bit) floating point registers, which can also be split into 64 single-precision (32-bit) floating point registers.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Registers<\/th>\nPreserved?<\/th>\n<\/tr>\n
s0\u2007<\/var> + s1\u2007<\/var><\/td>\nd0\u2007<\/var><\/td>\nNo<\/td>\n<\/tr>\n
s2\u2007<\/var> + s3\u2007<\/var><\/td>\nd1\u2007<\/var><\/td>\n<\/tr>\n
\u22ee<\/td>\n\u22ee<\/td>\n<\/tr>\n
s14<\/var> + s15<\/var><\/td>\nd7\u2007<\/var><\/td>\n<\/tr>\n
s16<\/var> + s17<\/var><\/td>\nd8\u2007<\/var><\/td>\nYes<\/td>\n<\/tr>\n
\u22ee<\/td>\n\u22ee<\/td>\n<\/tr>\n
s30<\/var> + s31<\/var><\/td>\nd15<\/var><\/td>\n<\/tr>\n
s32<\/var> + s33<\/var><\/td>\nd16<\/var><\/td>\nNo<\/td>\n<\/tr>\n
\u22ee<\/td>\n\u22ee<\/td>\n<\/tr>\n
s62<\/var> + s63<\/var><\/td>\nd31<\/var><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The ARM does not have branch delay slots. You can breathe a sigh of relief.<\/p>\n

The flags register is formally known as the Application Program Status Register (APSR). These flags are available to user mode:<\/p>\n\n\n\n\n\n\n\n\n\n
Mnemonic<\/th>\nMeaning<\/th>\nNotes<\/th>\n<\/tr>\n
N<\/td>\nNegative<\/td>\nSet if the result is negative<\/td>\n<\/tr>\n
Z<\/td>\nZero<\/td>\nSet if the result is zero<\/td>\n<\/tr>\n
C<\/td>\nCarry<\/td>\nMultiple purposes<\/td>\n<\/tr>\n
V<\/td>\nOverflow<\/td>\nSigned overflow<\/td>\n<\/tr>\n
Q<\/td>\nSaturation<\/td>\nAccumulated overflow<\/td>\n<\/tr>\n
GE[n]<\/td>\nGreater than or equal to<\/td>\n4 flags (SIMD)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The overflow flag records whether the most recent operation resulted in signed overflow. The saturation flag is used by multimedia instructions to accumulate whether any overflow occurred since it was last cleared. The GE flags record the result of SIMD operations. Flags are not preserved across calls.<\/p>\n

Under the Windows ABI, there is an 8-byte red zone beneath the stack pointer. However, you’ll never see the compiler using it because the red zone is reserved. It’s there for intrusive profilers.<\/p>\n

Intrusive profilers inject code into your binary to update hit counts. The ARM does not have an absolute addressing mode; access to memory is always indirect through registers. Therefore, the profiler needs to be able to “borrow” a register in order to access memory, and it does so by saving the current contents of two temporary registers to the red zone. This frees up just enough registers to be able to update profiling information.<\/p>\n

    str     r12, [sp, #-4]  ; save r12 into the red zone\r\n    str     r0,  [sp, #-8]  ; save r0  into the red zone\r\n\r\n    ; We can now use r12 and r0 to update profiling statistics.\r\n    ... do profiling stuff with r12 and r0 ...\r\n\r\n    ; All done. Restore the registers we borrowed.\r\n    ldr     r0,  [sp, #-8]  ; recover r0  from the red zone\r\n    ldr     r12, [sp, #-4]  ; recover r12 from the red zone\r\n<\/pre>\n
\u00b9 Windows CE also supported ARM, it supported both Thumb-2 mode and classic ARM, so  its ABI was different<\/a>. This series covers the Windows 10 ABI.<\/p>\n
\u00b2 Thumb-2 is an expansion of an earlier instruction set known unsurprisingly as Thumb. (Exercise: Why didn’t they call it Thumb-1?) The idea of using a 16-bit instruction set  came from the SuperH<\/a>, and ARM licensed it from Hitachi for use in Thumb mode.<\/p>\n
\u00b3 The use of r13<\/var> as the stack pointer is not architectural in classic ARM, but it is architectural in Thumb-2. Doing so frees up space in the tight 16-bit instruction encoding space.<\/p>\n
\u2074 In processor-speak, unpredictable<\/i> means that the processor can perform any operations it likes, provided they are permissible at the current privilege level. For example, an unpredictable<\/i> operation in user mode can set all registers to 42. But it cannot perform privileged operations, and the result cannot be dependent upon state that is not visible to user mode.<\/p>\n
\u2075 As with branch delay slots, the +4 effect of reading from the program counter is another example of how a clever hack in a processor’s original architecture turns into a compatibility constraint for future implementations.<\/p>\n","protected":false},"excerpt":{"rendered":"
Moving into the present.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-105265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":"
Moving into the present.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/105265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=105265"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/105265\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=105265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=105265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=105265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}