Memory: loads, stores, and addressing modes
prerequisite
Memory is one long row of bytes, and each byte has a number called its address. On AArch64 an address is 64 bits wide. Each running program gets its own private set of numbers, called virtual addresses, and the operating system maps them onto the real memory, so two programs can use the same address without getting in each other's way.
AArch64 is a load/store design: arithmetic instructions work only on registers. To change a value in memory, a program loads it into a register, works on it there, and stores the result back. The address always goes inside square brackets, so ldr w10, [x9] reads "load w10 from the address held in x9".
Four sizes, two ways to widen
A load or store moves 1, 2, 4 or 8 bytes. The size comes from the mnemonic's last letter (b for a byte, h for a halfword) or, for 4 and 8 bytes, from the register: a w register moves 4 bytes and an x register moves 8.
| bytes | store | load, zero-extended | load, sign-extended |
|---|---|---|---|
| 1 | strb w | ldrb w | ldrsb w or ldrsb x |
| 2 | strh w | ldrh w | ldrsh w or ldrsh x |
| 4 | str w | ldr w | ldrsw x |
| 8 | str x | ldr x | none needed: 8 bytes fill the register |
A store of fewer bytes than the register holds writes only the register's low bytes. A load of fewer bytes has to decide what goes in the register's upper bits:
- Zero extension fills them with 0s. Use it for a value that is never negative, such as a character code or a count.
- Sign extension fills them with copies of the value's top bit, so a negative value stays negative in the wider register. The
sinldrsb,ldrshandldrswasks for it.
The program below stores 0xf0 as a byte, 0xfffe as a halfword and -10 as a word, then loads each one back both ways. It prints:
byte 0xf0: ldrb = 240, ldrsb = -16halfword 0xfffe: ldrh = 65534, ldrsh = -2word 0xfffffff6: ldr = 4294967286, ldrsw = -10The byte 0xf0 has its top bit set. Zero-extended it is 240; sign-extended it is -16. The halfword works the same way: 65534 or -2. For the word, ldr w1 writes a w register, and writing a w register always clears bits 32 to 63 of the matching x register, so %ld sees 4294967286. ldrsw x2 copies the sign bit up into those bits, so %ld sees -10.
pitfall
The register picks the size of an ldr or str, not the label. ldr x1, [x9] on a .word reads the 4 bytes of the word and the 4 bytes after it, and prints nonsense as soon as something else is stored there. Match the register to the directive: .byte with ldrb or ldrsb, .hword with ldrh or ldrsh, .word with a w register or ldrsw, .dword with an x register.
Offsets and index registers
The part inside the brackets is the addressing mode: how the processor works out the address. These forms leave the base register unchanged:
| form | address used |
|---|---|
[x9] | x9 |
[x9, 8] | x9 + 8 |
[x9, x10] | x9 + x10 |
[x9, x10, LSL 2] | x9 + x10 * 4 |
[x9, w10, SXTW 2] | x9 + w10 * 4, with w10 read as signed |
[x9, w10, UXTW 2] | x9 + w10 * 4, with w10 read as unsigned |
In an array, element i sits at base + i * size, so the shift after LSL, SXTW or UXTW should match the element size: 0 for bytes, 1 for halfwords, 2 for words, 3 for doublewords. SXTW sign-extends a 32-bit index to 64 bits before adding it, which lets an index kept in a w register be negative. UXTW zero-extends it instead.
The program below adds up the same five-word array three ways: with a constant offset written out for each element, with a 64-bit index scaled by LSL 2, and with a 32-bit index widened and scaled by SXTW 2, the form course programs use most. It prints:
constant offsets total = 75lsl 2 index total = 75sxtw 2 index total = 75Pointers that move themselves
Two more forms change the base register as part of the access, so a pointer can walk along an array without a separate add:
| form | name | what happens |
|---|---|---|
[x9, 4]! | pre-index | add 4 to x9 first, then use the new x9 as the address |
[x9], 4 | post-index | use x9 as the address, then add 4 to x9 |
You have seen both already. stp fp, lr, [sp, -16]! is pre-index: it moves sp down, then stores. ldp fp, lr, [sp], 16 is post-index: it loads, then moves sp back up.
The program below sums the array once with each form. Each loop counts down with subs, which sets Z when the count reaches 0, so b.ne needs no cmp. It also prints how far past the start of the array each pointer finished:
post-index total = 75, pointer ends at arr + 20pre-index total = 75, pointer ends at arr + 16Both totals match, but the pointers stop in different places. Post-index stepped after its last load, so it finished 20 bytes in, one word past the end of the array. Pre-index stepped before each load, so it started one word before the array and finished 16 bytes in, on the last element.
Byte order
A word takes 4 bytes, so storing one fills 4 addresses. AArch64 on Linux is little-endian: the byte at the lowest address holds the least significant 8 bits of the value, the "little end". The program below stores 0x11223344 and reads its bytes back one at a time with ldrb. It prints:
0x11223344 in memory, lowest address first: 44 33 22 11The byte order only shows when a program reads a value at a different size from the one it stored. Store a word and load a word, and the bytes come back in the right order.
note
Keep each value at an address its own size divides evenly: a word at a multiple of 4, a doubleword at a multiple of 8. That is why .balign 4 goes before a .word that follows strings, whose lengths can be anything. Linux still lets an ordinary load or store use a badly aligned address, only more slowly, but sp is strict: using sp for a memory access while it is not a multiple of 16 stops the program. The next lesson keeps sp aligned.
pitfall
Common mistakes from this lesson, each with a broken program and its fix that you can run:
Check yourself
- A byte in memory holds
0x80. What doesldrb w1put inw1, and what doesldrsb w1put there, both printed with%d? x9holds the address of an array of words andw10holds 3. Which address doesldr w11, [x9, w10, SXTW 2]read?x9holds 1000. Which address doesldr w11, [x9], 4read, and what doesx9hold afterward? Answer the same forldr w11, [x9, 4]!starting from 1000 again.str w10, [x9]stores0x0a0b0c0d. Which byte sits at the address inx9?
answers
show answers
- 128 and -128. The top bit of
0x80is 1, so sign extension fills the upper bits with 1s. x9 + 12, the element at index 3.- Post-index reads address 1000 and leaves 1004 in
x9. Pre-index changesx9to 1004 first and reads address 1004. 0x0d, the least significant byte, because the machine is little-endian.
Practice
- Sum a global array: add up a
.bssarray with theSXTW 2load from this lesson. - Stack of plates: store four values at named offsets and load them back in reverse. It keeps them in a stack frame, which the next lesson explains.
- Mirror, mirror: reverse an array in place, one index walking in from each end.
- Which end is up?: print a word's four bytes in the order memory holds them.
- Basic quiz: memory and the stack: address size, byte loads, and alignment.
- Fill in the blank: memory and the stack (core): byte and halfword loads and stores, pre-index and post-index, and
SXTWoffsets. - Predict: memory and the stack (challenge): trace the addresses pre-index and post-index leave behind, and what
ldrbandldrsbload.