ARM Tips & Tricks

• Rotate left with extend (RLX) can be implemented as:

  ADC Rd, Rd, Rd
  

  Add the S modifier to have the carry flag updated.
• Setting a register to all 0s or all 1s depending on the state of the carry flag can be accomplished with:

  SBC Rd, Rd, Rd
  

• If all registers have unknown contents which must be preserved, there is only one known memory location which can be read from or written to: address 0, using a [Rn, -Rn] addressing mode. This can provide a useful bootstrap in implementing certain low-level operating system routines (e.g. breakpoint handler), for example:

  STR R0, [R0, -R0]       ; preserve R0 at address 0 so it is free to use
  MOV R0, #0x100          ; or any convenient register save block
  STMIB R0, {R1-R14}      ; save R1-R14
  LDR R1, [R0, -R0]       ; original R0
  STR R1, [R0]            ; save it too
  ; now all registers R0-R14 free to use
  ; ...
  MOV R0, #0x100          ; register save block
  LDMIA R0, {R0-R14}      ; restore all registers
  

  I first saw this technique used in a disassembly of the Arthur operating system.
• Loading an immediate value into a register can only be done in a single instruction if the value, or its one’s complement, can be represented as an 8-bit quantity rotated by an even number of bit positions (e.g. 0xFC000003 and 0x03FFFFFC are both acceptable). For other cases, a PC-relative load from a literal pool is typically used:

  LDR R0, const           ; assembles to: LDR R0, [PC, #offset]
  ...
  .const
  EQUD 0x55555555
  

  This takes 2 words of storage and typically 3 cycles to execute (one of which may be delayed if it’s missing the cache), so it would be better to use a sequence of 2 data processing instructions instead, if possible. It will often even be preferable to use a sequence of 3 data processing instructions - this trades off instruction cache for data cache. Of course any constant can be constructed with 4 data processing instructions (e.g.a MOV, ORR, ORR, ORR sequence), and the majority of “random” constants do require the full 4.
• ARM has had an integer multiplication instruction since ARMv2, but it can take up to 17 cycles. Later processors incorporated faster hardware multipliers, but even then it takes 5 cycles in general. If one of the multiplicands is known at compile-time, faster methods are available. Similarly, division by a known constant can be implemented much more efficiently than a general-purpose division algorithm. Some examples are given in the tables below.
  • Multiplication by a constant can always be done without using any scrap registers at all, although often this will be quite inefficient, making use of a temporary register preferable. There are 111 worst-case odd constants which require 12 instructions (12 cycles). Most “random” constants require 8 or 9 cycles.
  • If scrap registers are allowed, most constants can be done in 4 cycles or fewer. The worst-case is probably 5, but I haven’t confirmed that yet. In the range [−2¹⁴,2¹⁴], only ±14709 and ±15573, and some even numbers like ±1374, require 5 cycles, but the 5-cycle requirement becomes a bit more common with larger numbers (TODO: finish checking even + negative numbers).

• A CMP instruction has 7 possible outcomes in terms of flag configuration (the constraints are V ⇒ N⊕C, Z ⇒ N̅CV̅). A CMN instruction has 9 possible outcomes (the constraints are V ⇒ N⊕C, Z ⇒ N̅(C+V̅)): observe that CMN #0, #0 and CMN #1<<31, #1<<31 are special cases, leading to the 2 extra possibilities. If one of the arguments is fixed, there are in general 5 possible outcomes for either instruction (although sometimes as few as 3 for special values of the fixed argument). Thus multi-way switches can be built, for example:

  CMP R0, #0x80000001
  ; R0 = 0x7FFFFFFF => VS
  ; R0 = 0x80000000 => LT
  ; R0 = 0x80000001 => EQ
  ; R0 = 0x80000002 => HI
  

• You can set the C flag equal to any of {AND, OR, NAND, NOR} of any set of (cyclically) consecutive bits of a register in a single instruction, by making use of a CMN or CMP with appropriate shift and constant.
  This technique is used in some of the division rounding modes above.
• A running XOR, right-to-left (this is the inverse of the operation EOR R0, R0, R0 LSL #1):

  EOR R0, R0, R0 LSL #16
  EOR R0, R0, R0 LSL #8
  EOR R0, R0, R0 LSL #4
  EOR R0, R0, R0 LSL #2
  EOR R0, R0, R0 LSL #1
  

  The above operations are in fact commutative and so can be reordered freely.
  Or for left-to-right (this is the inverse of the operation EOR R0, R0, R0 LSR #1):

  EOR R0, R0, R0 LSR #16
  EOR R0, R0, R0 LSR #8
  EOR R0, R0, R0 LSR #4
  EOR R0, R0, R0 LSR #2
  EOR R0, R0, R0 LSR #1
  

  The operations EOR R0, R0, R0 ASR #1 and EOR R0, R0, R0 ROR #1 are 2-to-1, with inverse images also given by the above procedure and its (one’s) complement.
• Parity:

  EOR R0, R0, R0 ROR #16
  EOR R0, R0, R0 ROR #8
  EOR R0, R0, R0 ROR #4
  EOR R0, R0, R0 ROR #2
  EORS R0, R0, R0 ROR #1
  ; now R0 = 0 (even parity) or -1 (odd parity)
  ; also N = Z̅ = parity
  

  Variants of the final instruction can be used to get parity in the C or V flags.
  Instead using a preloaded value:

  ; Ru = 0x34CB34CB
  EOR R0, R0, R0 LSR #16
  EOR R0, R0, R0 LSR #8
  EOR R0, R0, R0 LSR #4
  MOVS R0, Ru ROR R0
  ; msb(R0) = N = parity (also C = parity, if C clear initially)
  

  Instead using a lookup table:

  ; R1 = pointer to 256-byte lookup table (1 byte per value)
  EOR R0, R0, R0 LSL #16
  EOR R0, R0, R0 LSL #8
  LDRB R0, [R1, R0 LSR #24]
  

  ; R1 = pointer to 32-byte lookup table (1 bit per value)
  EOR R0, R0, R0 ROR #16
  EOR R0, R0, R0 ROR #8
  LDR R2, [R1, R0 LSR #27]  ; requires unaligned loads to be aligned (not rotated)
  MOVS R0, R2 ROR R0
  ; msb(R0) = N = parity (also C = parity, if C clear initially)
  

• Population count (a.k.a. Hamming weight, sideways addition):

  ; Ru = 0x55555555, Rv = 0x33333333, Rw = 0x0F0F0F0F
  BIC R1, R0, Ru
  SUB R0, R0, R1 LSR #1
  AND R1, Rv, R0 LSR #2
  AND R0, R0, Rv
  ADD R0, R0, R1
  ADD R0, R0, R0 LSR #4
  AND R0, R0, Rw
  ADD R0, R0, R0 LSR #8
  ADD R0, R0, R0 LSR #16
  AND R0, R0, #0xFF
  

  Or with a multiply (likely slower):

  ; Ru = 0x55555555, Rv = 0x33333333, Rw = 0x0F0F0F0F, Rx = 0x01010101
  BIC R1, R0, Ru
  SUB R0, R0, R1 LSR #1
  AND R1, Rv, R0 LSR #2
  AND R0, R0, Rv
  ADD R0, R0, R1
  ADD R0, R0, R0 LSR #4
  AND R0, R0, Rw
  MUL R0, Rx, R0
  MOV R0, R0 LSR #24
  

• Swap two registers without using a temporary register:

  EOR R0, R0, R1
  EOR R1, R1, R0
  EOR R0, R0, R1
  

  (Using RSB instead of EOR throughout will result in swapping and negating both values. Other variants can selectively negate just R0 or R1.)
• Endian swap:

  EOR R1, R0, R0 ROR #16
  BIC R1, R1, #0xFF0000
  MOV R0, R0 ROR #8
  EOR R0, R0, R1 LSR #8
  

  Or with preloaded registers:

  ; Ru = 0xFF00FF
  AND R1, Ru, R0
  AND R0, Ru, R0 ROR #24
  ORR R0, R0, R1 ROR #8
  

• Detect zero byte in word (useful for dealing with null-terminated strings a word at a time):

  ; Ru = 0x01010101
  SUB R1, R0, Ru
  BIC R1, R1, R0
  TST R1, Ru LSL #7
  ; Z̅ = zero byte present
  

  Furthermore, bit 7 of R1 indicates whether the least significant byte is 0 (and if not, bit 15 corresponds to the next byte, etc.). A precheck which takes one fewer cycle but is only necessary and not sufficient:

  AND R1, R0, R0 LSL #16
  TST R1, R1 LSL #8
  ; Z = zero byte maybe present
  

  Unfortunately, random data will trigger this check about 60% of the time! ASCII text will fare better. Is there a better 2-cycle precheck?