What Is The Significance Of Putting The Square Brackets Around A Register Name

ARM uses a load-store model for memory access which means that just load/shop (LDR and STR) instructions can admission memory. While on x86 most instructions are immune to straight operate on data in retention, on ARM data must exist moved from memory into registers before existence operated on. This ways that incrementing a 32-bit value at a item memory accost on ARM would crave three types of instructions (load, increase, and store) to commencement load the value at a particular address into a register, increment it within the annals, and store it back to the memory from the register.

To explain the fundamentals of Load and Store operations on ARM, we beginning with a bones example and continue with three basic offset forms with three unlike address modes for each start form. For each example we will use the same piece of assembly code with a different LDR/STR offset form, to go on information technology simple. The best way to follow this part of the tutorial is to run the code examples in a debugger (GDB) on your lab surround.

Offset form: Firsthand value as the start
- Addressing fashion: Offset
- Addressing style: Pre-indexed
- Addressing manner: Post-indexed
Beginning form: Register every bit the kickoff
- Addressing manner: Commencement
- Addressing mode: Pre-indexed
- Addressing way: Mail service-indexed
Starting time form: Scaled annals as the start
- Addressing fashion: Showtime
- Addressing manner: Pre-indexed
- Addressing mode: Mail service-indexed

First basic example

More often than not, LDR is used to load something from retentiveness into a register, and STR is used to store something from a register to a memory address.

LDR R2, [R0]   @ [R0] - origin address is the value institute in R0. STR R2, [R1]   @ [R1] - destination address is the value found in R1.

LDR operation: loads thevalue at the address found in R0 to the destination register R2.

STR operation: stores the value found in R2 to the memory address constitute in R1.

This is how it would look like in a functional assembly plan:

.data          /* the .data department is dynamically created and its addresses cannot be easily predicted */ var1: .give-and-take 3  /* variable 1 in retentiveness */ var2: .give-and-take four  /* variable 2 in memory */  .text          /* start of the text (code) section */  .global _start  _start:     ldr r0, adr_var1  @ load the memory address of var1 via label adr_var1 into R0      ldr r1, adr_var2  @ load the memory address of var2 via label adr_var2 into R1      ldr r2, [r0]      @ load the value (0x03) at memory address found in R0 to register R2       str r2, [r1]      @ store the value found in R2 (0x03) to the retentiveness accost constitute in R1      bkpt               adr_var1: .word var1  /* address to var1 stored here */ adr_var2: .word var2  /* address to var2 stored here */

At the bottom we have our Literal Pool (a memory expanse in the same code section to store constants, strings, or offsets that others can reference in a position-independent style) where we shop the memory addresses of var1 and var2 (defined in the data department at the top) using the labels adr_var1 and adr_var2. The first LDR loads the address of var1 into register R0. The second LDR does the same for var2 and loads it to R1. And then we load the value stored at the memory address constitute in R0 to R2, and shop the value institute in R2 to the memory address found in R1.

When we load something into a register, the brackets ([ ]) mean: the value constitute in the annals between these brackets is a retentivity address we desire to load something from.

When we shop something to a memory location, the brackets ([ ]) mean: the value institute in the annals betwixt these brackets is a retentiveness address nosotros want to shop something to.

This sounds more complicated than information technology actually is, so hither is a visual representation of what's going on with the memory and the registers when executing the code above in a debugger:

Allow'southward look at the same code in a debugger.

                      gef>                    detach _start Dump of assembler code for office _start:  0x00008074 <+0>:      ldr  r0,          [pc, #12]          ; 0x8088 <adr_var1>  0x00008078 <+iv>:      ldr  r1,          [pc, #12]          ; 0x808c <adr_var2>  0x0000807c <+8>:      ldr  r2, [r0]  0x00008080 <+12>:     str  r2, [r1]  0x00008084 <+16>:     bx   lr Stop of assembler dump.

The labels we specified with the first two LDR operations changed to [pc, #12]. This is called PC-relative addressing. Because nosotros used labels, the compiler calculated the location of our values specified in the Literal Pool (PC+12). You can either calculate the location yourself using this verbal arroyo, or yous can use labels similar we did previously. The only departure is that instead of using labels, you need to count the exact position of your value in the Literal Pool. In this example, it is iii hops (4+4+iv=12) away from the effective PC position. More most PC-relative addressing later in this chapter.

Side note: In instance you forgot why the effective PC is located two instructions ahead of the electric current 1, it is described in Part two [… During execution, PC stores the address of the electric current teaching plus 8 (two ARM instructions) in ARM state, and the current instruction plus iv (two Thumb instructions) in Thumb state. This is dissimilar from x86 where PC always points to the adjacent instruction to exist executed…].

1.Offset form: Immediate value equally the offset

STR    Ra, [Rb,          imm] LDR    Ra, [Rc,          imm]

Here we employ an immediate (integer) as an offset. This value is added or subtracted from the base register (R1 in the example below) to admission information at an commencement known at compile time.

.information var1: .word 3 var2: .word 4  .text .global _start  _start:     ldr r0, adr_var1  @ load the retentivity address of var1 via label adr_var1 into R0     ldr r1, adr_var2  @ load the retentiveness address of var2 via label adr_var2 into R1     ldr r2, [r0]      @ load the value (0x03) at retentivity accost institute in R0 to register R2                      str r2, [r1, #2]                      @ address fashion: showtime. Store the value found in R2 (0x03) to the memory address constitute in          R1 plus 2. Base register (R1) unmodified.                                                    str r2, [r1, #4]!                      @ accost mode: pre-indexed. Store the value plant in R2 (0x03) to the memory address found in          R1 plus 4. Base register (R1) modified: R1 = R1+iv                                    ldr r3, [r1]            , #4                    @ address fashion: post-indexed. Load the value at retentiveness address establish in R1 to annals          R3. Base annals (R1) modified: R1 = R1+4      bkpt  adr_var1: .give-and-take var1 adr_var2: .word var2

Allow's call this plan ldr.s, compile it and run information technology in GDB to encounter what happens.

$ as ldr.s -o ldr.o $ ld ldr.o -o ldr $ gdb ldr

In GDB (with gef) we gear up a intermission betoken at _start and run the program.

                      gef>                    break _start                      gef>                    run ...                      gef>                    nexti three     /* to run the next 3 instructions */

The registers on my organization are now filled with the post-obit values (keep in mind that these addresses might be different on your system):

$r0 :          0x00010098          -> 0x00000003 $r1 :          0x0001009c          -> 0x00000004 $r2 :          0x00000003          $r3 : 0x00000000 $r4 : 0x00000000 $r5 : 0x00000000 $r6 : 0x00000000 $r7 : 0x00000000 $r8 : 0x00000000 $r9 : 0x00000000 $r10 : 0x00000000 $r11 : 0x00000000 $r12 : 0x00000000 $sp : 0xbefff7e0 -> 0x00000001 $lr : 0x00000000 $pc : 0x00010080 -> <_start+12> str r2, [r1] $cpsr : 0x00000010

The next instruction that will be executed a STR functioning with the beginning address mode . Information technology will shop the value from R2 (0x00000003) to the memory address specified in R1 (0x0001009c) + the offset (#ii) = 0x1009e.

                      gef>                    nexti                      gef>                      x/w 0x1009e  0x1009e <var2+2>: 0x3

The next STR operation uses the pre-indexed address way . You tin recognize this manner by the exclamation mark (!). The only difference is that the base of operations register will be updated with the final memory address in which the value of R2 volition be stored. This means, nosotros store the value found in R2 (0x3) to the retentivity accost specified in R1 (0x1009c) + the beginning (#iv) = 0x100A0, and update R1 with this exact address.

                      gef>                      nexti                          gef>                    10/westward 0x100A0 0x100a0: 0x3                      global environment facility>                    info register r1 r1          0x100a0          65696

The last LDR operation uses the post-indexed accost mode . This means that the base annals (R1) is used as the final address, then updated with the offset calculated with R1+iv. In other words, it takes the value found in R1 (not R1+four), which is 0x100A0 and loads it into R3, so updates R1 to R1 (0x100A0) + offset (#iv) = 0x100a4.

                      gef>                    info register r1 r1          0x100a4          65700                      global environment facility>                    info register r3 r3          0x3          iii

Here is an abstract illustration of what'south happening:

ii.Offset form: Register as the offset.

STR    Ra, [Rb,          Rc] LDR    Ra, [Rb,          Rc]

This offset form uses a register as an kickoff. An instance usage of this offset grade is when your code wants to access an array where the index is computed at run-time.

.data var1: .give-and-take three var2: .word 4  .text .global _start  _start:     ldr r0, adr_var1  @ load the retentivity address of var1 via label adr_var1 to R0      ldr r1, adr_var2  @ load the memory accost of var2 via label adr_var2 to R1      ldr r2, [r0]      @ load the value (0x03) at memory address constitute in R0 to R2                                    str r2, [r1, r2]                      @ accost mode: start. Shop the value found in R2 (0x03) to the retention address found in R1 with the commencement R2 (0x03). Base annals unmodified.                                    str r2, [r1, r2]!                      @ address manner: pre-indexed. Store value found in R2 (0x03) to the memory accost institute in R1 with the get-go R2 (0x03). Base register modified: R1 = R1+R2.                      ldr r3, [r1], r2                                @ accost mode: mail-indexed. Load value at memory address found in R1 to register R3. And then modify base of operations register: R1 = R1+R2.     bx lr  adr_var1: .word var1 adr_var2: .discussion var2

Later executing the first STR operation with the commencement address mode , the value of R2 (0x00000003) will be stored at memory accost 0x0001009c + 0x00000003 = 0x0001009F.

                      gef>                    x/w 0x0001009F  0x1009f <var2+3>: 0x00000003

The 2d STR operation with the pre-indexed address fashion will do the aforementioned, with the deviation that it will update the base register (R1) with the calculated retention accost (R1+R2).

                      global environment facility>                    info annals r1  r10x1009f          65695

The terminal LDR performance uses the postal service-indexed address mode and loads the value at the memory address plant in R1 into the register R2, then updates the base of operations register R1 (R1+R2 = 0x1009f + 0x3 = 0x100a2).

                      gef>                    info annals r1  r1          0x100a2          65698                      global environment facility>                    info register r3  r30x3          3

3.Offset grade: Scaled register as the kickoff

LDR    Ra, [Rb,          Rc, <shifter>] STR    Ra, [Rb,          Rc, <shifter>]

The third offset form has a scaled annals as the offset. In this instance, Rb is the base of operations register and Rc is an immediate offset (or a register containing an immediate value) left/right shifted (<shifter>) to scale the immediate. This means that the barrel shifter is used to calibration the outset. An case usage of this offset form would be for loops to iterate over an array. Here is a simple example you can run in GDB:

.data var1: .word 3 var2: .word 4  .text .global _start  _start:     ldr r0, adr_var1         @ load the retention accost of var1 via characterization adr_var1 to R0     ldr r1, adr_var2         @ load the memory address of var2 via label adr_var2 to R1     ldr r2, [r0]             @ load the value (0x03) at memory address plant in R0 to R2                      str r2, [r1, r2, LSL#2]                                @ address mode: commencement. Store the value institute in R2 (0x03) to the memory address found in R1 with the offset R2 left-shifted past 2. Base register (R1) unmodified.                      str r2, [r1, r2, LSL#2]!                      @ address mode: pre-indexed. Shop the value found in R2 (0x03) to the memory address found in R1 with the starting time R2 left-shifted by 2. Base annals modified: R1 = R1 + R2<<2                                    ldr r3, [r1], r2, LSL#2                                @ address way: mail-indexed. Load value at retention address found in R1 to the annals R3. And then modifiy base annals: R1 = R1 + R2<<ii     bkpt  adr_var1: .word var1 adr_var2: .word var2

The offset STR performance uses the offset address mode and stores the value found in R2 at the memory location calculated from [r1, r2, LSL#2], which ways that information technology takes the value in R1 as a base (in this case, R1 contains the memory address of var2), then information technology takes the value in R2 (0x3), and shifts it left by 2. The moving picture below is an endeavor to visualize how the retentiveness location is calculated with [r1, r2, LSL#ii].

The second STR performance uses the pre-indexed address mode . This means, it performs the aforementioned activity every bit the previous operation, with the difference that it updates the base annals R1 with the calculated retentiveness address later. In other words, it will first store the value found at the memory accost R1 (0x1009c) + the offset left shifted by #2 (0x03 LSL#2 = 0xC) = 0x100a8, and update R1 with 0x100a8.

                      global environment facility>                    info register r1 r1           0x100a8          65704

The last LDR operation uses the mail-indexed address fashion . This means, it loads the value at the memory accost found in R1 (0x100a8) into register R3, then updates the base of operations register R1 with the value calculated with r2, LSL#ii. In other words, R1 gets updated with the value R1 (0x100a8) + the offset R2 (0x3) left shifted by #2 (0xC) = 0x100b4.

                      gef>                    info register r1 r10x100b4          65716

Summary

Remember the 3 kickoff modes in LDR/STR:

offset mode uses an immediate equally offset
- ldr r3, [r1, #four]
start mode uses a register as offset
- ldr r3, [r1, r2]
offset mode uses a scaled annals equally offset
- ldr r3, [r1, r2, LSL#ii]

How to remember the dissimilar address modes in LDR/STR:

If there is a !, information technology's prefix address way
- ldr r3, [r1, #4]!
- ldr r3, [r1, r2]!
- ldr r3, [r1, r2, LSL#ii]!
If the base register is in brackets past itself, it'southward postfix address mode
- ldr r3, [r1], #4
- ldr r3, [r1], r2
- ldr r3, [r1], r2, LSL#two
Annihilation else is showtime address mode.
- ldr r3, [r1, #4]
- ldr r3, [r1, r2]
- ldr r3, [r1, r2, LSL#two]

LDR is not only used to load data from memory into a register. Sometimes you will see syntax like this:

.section .text .global _start  _start:    ldr r0, =leap        /* load the accost of the function label bound into R0 */    ldr r1, =0x68DB00AD  /* load the value 0x68DB00AD into R1 */ jump:    ldr r2, =511         /* load the value 511 into R2 */     bkpt

These instructions are technically called pseudo-instructions. We can utilise this syntax to reference data in the literal puddle. The literal puddle is a retentiveness surface area in the same section (because the literal puddle is part of the code) to store constants, strings, or offsets. In the example above we utilise these pseudo-instructions to reference an offset to a function, and to motion a 32-fleck constant into a register in one pedagogy. The reason why nosotros sometimes demand to utilize this syntax to move a 32-bit abiding into a register in one teaching is because ARM can only load a 8-flake value in one go. What? To understand why, you need to know how immediate values are being handled on ARM.

Loading immediate values in a register on ARM is not as straightforward as information technology is on x86. At that place are restrictions on which immediate values you can utilise. What these restrictions are and how to deal with them isn't the most heady office of ARM assembly, but bear with me, this is just for your understanding and there are tricks you tin use to featherbed these restrictions (hint: LDR).

We know that each ARM instruction is 32bit long, and all instructions are provisional. There are xvi condition codes which we tin can apply and one condition code takes upwardly four $.25 of the instruction. And so we need 2 bits for the destination annals. two $.25 for the first operand register, and i bit for the set-status flag, plus an assorted number of $.25 for other matters like the actual opcodes. The bespeak here is, that afterwards assigning $.25 to educational activity-type, registers, and other fields, in that location are only 12 bits left for immediate values, which will but permit for 4096 unlike values.

This means that the ARM instruction is only able to use a limited range of immediate values with MOV straight. If a number tin't be used direct, it must be split into parts and pieced together from multiple smaller numbers.

Only there is more than. Instead of taking the 12 $.25 for a unmarried integer, those 12 bits are carve up into an 8bit number (north) being able to load any 8-bit value in the range of 0-255, and a 4bit rotation field (r) being a right rotate in steps of 2 betwixt 0 and 30. This ways that the full firsthand value v is given by the formula: five = due north ror 2*r. In other words, the only valid immediate values are rotated bytes (values that can exist reduced to a byte rotated past an even number).

Here are some examples of valid and invalid immediate values:

Valid values: #256        // 1 ror 24 --> 256 #384        // 6 ror 26 --> 384 #484        // 121 ror 30 --> 484 #16384      // 1 ror eighteen --> 16384 #2030043136 // 121 ror 8 --> 2030043136 #0x06000000 // 6 ror viii --> 100663296 (0x06000000 in hex)  Invalid values: #370        // 185 ror          31 -->                      31 is not in range (0 – 30)          #511        // 1 1111 111ane          --> scrap-pattern can't fit into one byte #0x06010000 // 1 chiliad 000i.. --> bit-pattern can't fit into one byte

This has the effect that information technology is not possible to load a full 32bit address in i go. We can bypass this restrictions by using 1 of the post-obit two options:

Construct a larger value out of smaller parts
1. Instead of using MOV r0, #511
2. Carve up 511 into two parts: MOV r0, #256, and Add together r0, #255
Apply a load construct 'ldr r1,=value' which the assembler will happily convert into a MOV, or a PC-relative load if that is not possible.
1. LDR r1, =511

If you endeavor to load an invalid immediate value the assembler will complain and output an error maxim: Error: invalid abiding. If you encounter this error, you at present know what it means and what to do nigh it.
Let's say you desire to load #511 into R0.

.section .text .global _start  _start:     mov     r0, #511     bkpt

If yous try to assemble this lawmaking, the assembler will throw an mistake:

azeria@labs:~$ as test.south -o test.o test.s: Assembler messages: test.due south:5: Error: invalid abiding (1ff) subsequently fixup

Yous need to either split 511 in multiple parts or you use LDR as I described before.

.section .text .global _start  _start:  mov r0, #256   /* 1 ror 24 = 256, then it'due south valid */  add r0, #255   /* 255 ror 0 = 255, valid. r0 = 256 + 255 = 511 */  ldr r1, =511   /* load 511 from the literal pool using LDR */  bkpt

If you demand to figure out if a certain number can be used every bit a valid immediate value, you don't need to calculate it yourself. Y'all tin can use my piddling python script chosen rotator.py which takes your number as an input and tells you lot if it can be used as a valid immediate number.

azeria@labs:~$ python rotator.py Enter the value you desire to check: 511  Sorry, 511 cannot be used as an firsthand number and has to be split.  azeria@labs:~$ python rotator.py Enter the value you want to check: 256  The number 256 tin be used as a valid immediate number. 1 ror 24 --> 256