{"id":105288,"date":"2021-06-07T07:00:00","date_gmt":"2021-06-07T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=105288"},"modified":"2021-06-07T07:19:57","modified_gmt":"2021-06-07T14:19:57","slug":"20210607-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20210607-00\/?p=105288","title":{"rendered":"The ARM processor (Thumb-2), part 6: The lie hiding inside the CMN instruction"},"content":{"rendered":"

Last time, we learned that the CMN<\/code> instruction stands for compare negative<\/i><\/a>, and it compares its first argument with the negative of the second argument:<\/p>\n

    ; compare negative (compare Rn with -op2)\r\n    cmn     Rn, op2             ; Set flags for Rn + op2\r\n<\/pre>\n
We noted that the N<\/code> in the name is misleading, because it stands for negative<\/i>, even though in the seemingly-analogous MVN<\/code> instruction, the N<\/code> stands for not<\/i>.<\/p>\n
But that’s not the most misleading part of the CMN<\/code> instruction.<\/p>\n
The big lie about the compare negative<\/i> instruction is that it doesn’t even compare the negative<\/i>.<\/p>\n
You had one job!<\/p>\n
The compare negative<\/i> instruction is defined in terms of addition, rather than subtraction of the negative. Mathematically, the operations are identical: Subtracting a negative is the same as adding the positive.<\/p>\n
But computers aren’t operating on mathematical integers.<\/p>\n
Let’s look more closely at the difference between subtraction of the negative and addition of the positive. Recall that subtraction in a true-carry system is rewritten as addition, using the identity -x = ~x + 1<\/code>. Therefore, a - b<\/code> becomes a + ~b + 1<\/code>. And the carry for this operation is the combined carry from both<\/i> additions.<\/p>\n
On the other hand, the CMN<\/code> instruction is implemented as a straight addition, not a subtraction of the negative.<\/p>\n\n\n\n\n\n
Expression<\/td>\nEvaluated as<\/td>\n<\/tr>\n
a - (-b)<\/code><\/td>\nlet c = ~b + 1<\/code>
\nresult = a + ~c + 1<\/code><\/td>\n<\/tr>\n
a + b<\/code><\/td>\nresult = a + b<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
One difference between the two is that in the “subtract the negative” version, the carry that occurs in the calculation of ~c + 1<\/code> contributes to the final carry, whereas that extra carry disappears in the “add the positive” version.<\/p>\n
When would ~c + 1<\/code> generate a carry?<\/p>\n
Answer: When c<\/code> is zero, because we have ~c + 1 = ~0 + 1 = 0xFFFFFFFF + 1<\/code>, and that sum generates a carry. And c<\/code> is zero when b<\/code> is zero.<\/p>\n
On the other hand, if b<\/code> is zero, then a + b<\/code> never generates a carry because you’re just adding zero, which does nothing.<\/p>\n
Conclusion: If the second parameter to CMN<\/code> is zero, then CMN<\/code> results in no carry, even though “subtracting the negative of zero” would have produced a carry.<\/p>\n
In other words, these two sequences do not generate the same flags:<\/p>\n
    ; compare r0 against negative r1 using single instruction\r\n    cmn     r0, r1          ; set flags for (r0 + r1)\r\n\r\n    ; compare r0 against negative r1 using two instructions\r\n    rsb     r12, r1, #0     ; r12 = negative r1\r\n    cmp     r0, r12         ; set flags for (r0 - r12)\r\n<\/pre>\n
In the case where r1<\/var> is zero, the first version clears carry, but the second version sets carry. This means that if you follow the CMN<\/code> with a conditional branch that consumes carry, you will get the wrong answer if the second parameter happens to be zero.<\/p>\n
We haven’t learned about ARM conditionals yet, but when we do, you’ll discover that it is the unsigned relative comparison conditionals\u00b9 that are based on the carry flag. Therefore, don’t use the CMN<\/code> instruction to make unsigned relative comparisons against values which might be zero, because the carry flag may be set incorrectly.<\/p>\n
Fortunately, this problem is relatively easy to avoid:<\/p>\n
First rule: Don’t use<\/p>\n
    cmn     Rd, #0\r\n<\/pre>\n
Don’t hard-code zero as the second parameter because the carry won’t be set properly.\u00b2 Just write it as the positive comparison:<\/p>\n
    cmp     Rd, #0\r\n<\/pre>\n
This is even easier to write, and it doesn’t have the carry flag problem.<\/p>\n
Second rule: If you use a register or shifted register as the second parameter to CMN<\/code>, don’t follow it with a condition that relies on the carry flag. In practice, this means that you should use signed conditions to test the result rather than unsigned conditions. (We haven’t learned about conditions yet.)<\/p>\n
Fortunately, this second rule is not that much of a problem, because the fact that you are “comparing against the negative” strongly implies that you are interpreting the comparison as between two signed integers, so you are unlikely to follow up with an unsigned relative comparison conditional.<\/p>\n
Okay, so that takes care of carry. The other troublesome bit is the overflow bit, which is just the carry from bit 30 into 31.<\/p>\n
What are the cases in which a carry from bit 30 to bit 31 would be lost? We already identified zero as one of those cases. The other case is where the value is 0x80000000<\/code>.<\/p>\n
Ah, the curse of the most negative integer.<\/p>\n
Ignoring the overflow from bit 30 to bit 31 means that the negative of 0x80000000<\/code> is treated as the positive number +0x80000000<\/code>. Since every two’s complement 32-bit integer is less than +0x80000000<\/code> (viewed as a large positive number), the result of the comparison is pretty much foregone. It will always say “less than”.<\/p>\n
In a way, though, the curse of the most negative integer isn’t so much of a problem here. After all, you did ask to compare against the negative of the most negative integer, and that’s a positive number that’s so positive it can’t even be represented!<\/p>\n
Wow, what a complicated, messed-up instruction CMN<\/code> turned out to be.<\/p>\n
Next time, we’ll return to our exploration of the ARM Thumb-2 instruction set by looking at bitwise operations.<\/p>\n
\u00b9 The unsigned relative comparison conditionals are “unsigned less than”, “unsigned less than or equal”, “unsigned greater than”, and “unsigned greater than or equal”.<\/p>\n
\u00b2 Note that everything is fine if the second argument is not zero.<\/p>\n
    ; compare against 0xFFFFFFFE.\r\n    ; this works properly even for unsigned comparison.\r\n    cmn     r1, #2\r\n<\/pre>\n
The problematic case for unsigned comparisons occurs only when the second argument is zero.<\/p>\n","protected":false},"excerpt":{"rendered":"
Don’t let the name fool you.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-105288","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":"
Don’t let the name fool you.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/105288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=105288"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/105288\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=105288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=105288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=105288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}