Every instruction is 32 bits

Reading a word by position

The bits of a word are numbered from 31 on the left (the most significant bit) down to 0 on the right. A field is a run of neighboring bits with one job, such as naming a register or holding a constant. A field is named by its end positions: "bits 9 to 5" is a five-bit field.

Hex is the easiest way to write a word down, because each hex digit stands for exactly four bits. To split a word, write each of its eight hex digits as four binary digits, then ignore the groups of four and cut the 32 bits again where the fields begin and end. To go the other way, line the fields up, regroup the bits in fours from the left, and read off the hex.

Three facts hold in every format below that names a register:

• A register is named by a 5-bit number from 0 to 31: x0argument and return register (x0-x7): carries the first eight arguments and the return value. is 00000, x9caller-saved temporary (x9-x15): a called routine may overwrite it. is 01001, x29frame pointer (x29 / fp): points to the current function's stack frame. (fpframe pointer (x29 / fp): points to the current function's stack frame.) is 11101, and x30link register (x30 / lr): holds the return address set by bl. (lrlink register (x30 / lr): holds the return address set by bl.) is 11110. The number 31 (11111) means the zero register or spstack pointer (sp): points to the top of the stack; keep it a multiple of 16., depending on the instruction.
• The x and w views of a register share one number. In the arithmetic formats a separate bit picks the width: the size bit sf, bit 31, is 1 for 64-bit x registers and 0 for 32-bit w registers.
• The register being written (or, for a load or store, the register being transferred) sits at the right end, in bits 4 to 0. The first source register comes next, in bits 9 to 5.

Five formats

The top bits of a word, the opcode, say which operation it holds and therefore how to read the rest of it. Instructions that need the same kinds of operands share one layout, called a format. Textbooks name five of them with short letters:

Each row covers all 32 bits with no gaps. Rd is the destination, Rn and Rm are the first and second sources, and Rt is the register a load writes or a store reads. A field whose name starts with imm holds an immediate, a constant stored inside the instruction itself, and the number in its name is its width in bits: imm12 is 12 bits.

The ARM manual cuts the opcode into smaller named parts and has many more layouts (logical instructions, movzMove wide zero-extended; writes imm << hw*16, zeros the rest., loads with a plain offset, floating point). These five cover the instructions you write most often, and every other layout is read the same way.

The register format

add x9, x9, x12, from the second program on this page, assembles to 0x8b0c0129. Taken apart:

The 11-bit opcode packs several choices together. Bit 31 is sf. Bit 30, op, is 0 for add and 1 for subtract. Bit 29, S, is 1 for the versions that set the flags, addsRd = Rn + Rm/imm, and sets the NZCV condition flags. and subsRd = Rn - Rm/imm, sets NZCV (the basis of CMP).. Bits 23 and 22 choose the kind of shift applied to Rm (00 is lslLogical shift left (Rd = Rn << amount).), and imm6 holds how far to shift it. With no shift written, imm6 is 0. The four 64-bit opcodes differ only in bits 30 and 29:

On w registers bit 31 is 0, which takes 0x400 off each value: addRd = Rn + Rm/imm. No flags. on w registers is 0x058.

Some familiar mnemonics are other instructions under a second name, called aliases. cmp x9, x12 is really subs xzr, x9, x12: a subtraction that sets the flags and sends its result to register 31, where it is thrown away. Its word, 0xeb0c013f, ends in 11111 for that reason.

The program below does this split in code. The line labelled specimen is the instruction it inspects: ldr x9, =specimen gets that line's address, exactly as ldr x0, =fmt gets a string's, and ldr word_r, [x9] reads its four bytes as one number. Then ubfxUnsigned bitfield extract: Rd = (Rn >> lsb) & ((1 << width) - 1). (unsigned bitfield extract, from the shifts and bitfields lesson) copies each field into the low bits of an argument register for printf.

Running it prints:

Try a few edits to the specimen line and run again:

• add w13, w14, w15: sf becomes 0, the opcode reads 0x058, imm6 reads 0, and the word is 0x0b0f01cd.
• sub x13, x14, x15, lsl 2: only bit 30 changes, so the opcode reads 0x658 and the word is 0xcb0f09cd.
• adds x13, x14, x15, lsl 2: bit 29 turns on, and the opcode reads 0x558.

The immediate format

When the second operand is a constant, the constant goes inside the instruction. sub w11, w11, 1 assembles to 0x5100056b:

The opcode starts with the same three choices as the register format, sf, op and S: here 0 (32-bit), 1 (subtract) and 0 (no flags). The next six bits, 100010, mark the add and subtract immediate family. The last opcode bit is sh.

imm12 is a 12-bit unsigned number, so one addRd = Rn + Rm/imm. No flags. or subRd = Rn - Rm/imm. No flags. can carry a constant from 0 to 4095. When sh is 1, the constant is shifted left 12 places before use, which reaches multiples of 4096: add x10, x11, 8192 is stored as imm12 = 2 with sh = 1. A constant that fits neither way cannot be an immediate. It has to be put in a register first, the way the registers and immediates lesson builds one with movzMove wide zero-extended; writes imm << hw*16, zeros the rest. and movkMove wide, keep. Writes imm << hw*16 but preserves the other halfwords..

Encoding one by hand

Going from an instruction to its word is the same work in the other direction:

1. Pick the format from the instruction's operands.
2. Write each field in binary at its full width, with leading zeros.
3. Put the fields side by side, opcode first, to make 32 bits.
4. Cut those 32 bits into groups of four from the left and read each group as a hex digit.

For add x10, x11, 300:

To check a hand encoding, make it the specimen line in the program above and read the word line. Ignore the second line for an immediate: it splits the word the register-format way, which does not apply here.

The load and store format

The D format covers ldrLoad from memory. Picks 32-vs-64 bit based on Wt/Xt. and strStore to memory. Same addressing modes as LDR. with pre-index or post-index addressing. ldr x12, [x10], 8 assembles to 0xf840854c:

• The opcode's first two bits give the access size: 11 for 8 bytes (an x register) and 10 for 4 bytes (a w register). Its second-to-last bit is 1 for a load and 0 for a store, so str x12, [x10], 8 starts 11111000000.
• imm9 is the step in bytes. It is signed, so it runs from -256 to 255, and a negative step is stored in two's complement, the same way a negative number is stored in a register.
• op2 picks the addressing mode: 01 is post-index (use the address in Rn, then add the step to Rn) and 11 is pre-index (add the step first, then use the new address; written with !).
• Rn is the base register holding the address, and Rt is the register loaded or stored.

The plain offset form, ldr x0, [x1, 16], uses a different layout with a 12-bit unsigned offset counted in units of the access size. Its bit diagram is on the ldr reference entry.

Branches count in instructions

A branch does not store the address it jumps to. It stores an offset: how far the target is from the branch instruction itself, counted in instructions, not bytes. Every instruction is 4 bytes, so a byte distance always ends in two 0 bits; the format leaves them out and multiplies by 4 when the branch runs, which gives the same field four times the reach. A backward jump has a negative offset, stored in two's complement.

• The B format, for bUnconditional branch to label (±128 MiB). and blBranch with link; writes return address to X30., has a 6-bit opcode (000101 for bUnconditional branch to label (±128 MiB)., 100101 for blBranch with link; writes return address to X30.) and a 26-bit offset, imm26. That reaches 2^25 instructions, 128 MB, in either direction.
• The CB format, for b.condConditional branch (write as B.EQ, B.NE, B.LT, ...)., has the opcode 01010100, a 19-bit offset imm19 (1 MB either way), a 0 bit, and a 4-bit condition code.

The condition codes you will meet most:

Two branches from the loop in the program below. b sum_test jumps four instructions ahead to the loop's test, and b.gt sum_topConditional branch (write as B.EQ, B.NE, B.LT, ...). jumps four instructions back to the loop's first instruction:

Because the offset is relative, a branch word does not change when the whole program is loaded at a different address. It changes only when the distance to the target changes.

A program that reads its own machine code

The program below adds four numbers in a loop, then prints the words of five of the loop's instructions, one from each format. The loop has the test at the bottom: b sum_test jumps straight to the test, so a list of zero numbers would skip the body entirely. Each inspected instruction has a label (enc_b, enc_ldr and so on) so the program can find it with ldr =label, the same way it finds a string. The text beside each word is an ordinary string showing the line after m4 has replaced the register names.

Running it prints:

Two edits worth making:

• Add a line holding nopDo nothing; PC advances. (an instruction that does nothing) just above enc_sub:. The sum stays 124, but both branches now cross one more instruction: bUnconditional branch to label (±128 MiB). becomes 0x14000005 (+5) and b.gtConditional branch (write as B.EQ, B.NE, B.LT, ...). becomes 0x54ffff6c (-5). No other word changes.
• Change the subRd = Rn - Rm/imm. No flags. to subtract 2. The loop runs twice, so the sum becomes 17, and the subRd = Rn - Rm/imm. No flags. word becomes 0x5100096b because imm12 now holds 2. The text beside it stays as it was, since it is only a string.

Check yourself

1. Decode 0xcb0a0128. Which instruction is it?
2. Encode a b.neConditional branch (write as B.EQ, B.NE, B.LT, ...). whose target is three instructions before the branch.
3. What is the largest constant imm12 can hold, and what does setting sh do to it?

Practice

• Assemble it yourself: build the 32-bit word for add xD, xN, imm from its fields.
• Machine code detective: take a register add or subtract word apart and print the instruction.
• Intermediate quiz: system architecture: why a fixed instruction size helps the processor.
• Basic quiz: ARMv8 assembly, then core: which instruction an alias really encodes.
• The reference has worked bit diagrams for add, sub, ldr and b.