ARM Dependent Features
**********************

Options
=======

-mcpu=PROCESSOR[+EXTENSION...]
     This option specifies the target processor.  The assembler will issue an error message if an attempt is made to assemble an instruction which will not execute on the target processor.  The following processor names are recognized: arm1, arm2, arm250, arm3, arm6, arm60, arm600, arm610, arm620, arm7, arm7m, arm7d, arm7dm, arm7di, arm7dmi, arm70, arm700, arm700i, arm710, arm710t, arm720, arm720t, arm740t, arm710c, arm7100, arm7500, arm7500fe, arm7t, arm7tdmi, arm7tdmi-s, arm8, arm810, strongarm, strongarm1, strongarm110, strongarm1100, strongarm1110, arm9, arm920, arm920t, arm922t, arm940t, arm9tdmi, fa526 (Faraday FA526 processor), fa626 (Faraday FA626 processor), arm9e, arm926e, arm926ej-s, arm946e-r0, arm946e, arm946e-s, arm966e-r0, arm966e, arm966e-s, arm968e-s, arm10t, arm10tdmi, arm10e, arm1020, arm1020t, arm1020e, arm1022e, arm1026ej-s, fa626te (Faraday FA626TE processor), fa726te (Faraday FA726TE processor), arm1136j-s, arm1136jf-s, arm1156t2-s, arm1156t2f-s, arm1176jz-s, arm1176jzf-s, mpcore, mpcorenovfp, cortex-a5, cortex-a8, cortex-a9, cortex-r4, cortex-r4f, cortex-m3, cortex-m1, cortex-m0, ep9312 (ARM920 with Cirrus Maverick coprocessor), i80200 (Intel XScale processor) iwmmxt (Intel(r) XScale processor with Wireless MMX(tm) technology coprocessor) and xscale. The special name all may be used to allow the assembler to accept instructions valid for any ARM processor.

     In addition to the basic instruction set, the assembler can be told to accept various extension mnemonics that extend the processor using the co-processor instruction space.  For example, -mcpu=arm920+maverick is equivalent to specifying -mcpu=ep9312.  The following extensions are currently supported: +maverick +iwmmxt and +xscale.

-march=ARCHITECTURE[+EXTENSION...]
     This option specifies the target architecture.  The assembler will issue an error message if an attempt is made to assemble an instruction which will not execute on the target architecture.  The following architecture names are recognized: armv1, armv2, armv2a, armv2s, armv3, armv3m, armv4, armv4xm, armv4t, armv4txm, armv5, armv5t, armv5txm, armv5te, armv5texp, armv6, armv6j, armv6k, armv6z, armv6zk, armv7, armv7-a, armv7-r, armv7-m, armv7e-m, iwmmxt and xscale. If both -mcpu and -march are specified, the assembler will use the setting for -mcpu.

     The architecture option can be extended with the same instruction set extension options as the -mcpu option.

-mfpu=FLOATING-POINT-FORMAT

     This option specifies the floating point format to assemble for.  The assembler will issue an error message if an attempt is made to assemble an instruction which will not execute on the target floating point unit. The following format options are recognized: softfpa, fpe, fpe2, fpe3, fpa, fpa10, fpa11, arm7500fe, softvfp, softvfp+vfp, vfp, vfp10, vfp10-r0, vfp9, vfpxd, vfpv2, vfpv3, vfpv3-fp16, vfpv3-d16, vfpv3-d16-fp16, vfpv3xd, vfpv3xd-d16, vfpv4, vfpv4-d16, arm1020t, arm1020e, arm1136jf-s, maverick, neon, and neon-vfpv4.

     In addition to determining which instructions are assembled, this option also affects the way in which the .double assembler directive behaves when assembling little-endian code.

     The default is dependent on the processor selected.  For Architecture 5 or later, the default is to assembler for VFP instructions; for earlier architectures the default is to assemble for FPA instructions.

-mthumb
     This option specifies that the assembler should start assembling Thumb instructions; that is, it should behave as though the file starts with a .code 16 directive.

-mthumb-interwork
     This option specifies that the output generated by the assembler should be marked as supporting interworking.

-mimplicit-it=never
-mimplicit-it=always
-mimplicit-it=arm
-mimplicit-it=thumb
     The -mimplicit-it option controls the behavior of the assembler when conditional instructions are not enclosed in IT blocks. There are four possible behaviors. If never is specified, such constructs cause a warning in ARM code and an error in Thumb-2 code. If always is specified, such constructs are accepted in both ARM and Thumb-2 code, where the IT instruction is added implicitly. If arm is specified, such constructs are accepted in ARM code and cause an error in Thumb-2 code. If thumb is specified, such constructs cause a warning in ARM code and are accepted in Thumb-2 code.  If you omit this option, the behavior is equivalent to -mimplicit-it=arm.

-mapcs-26
-mapcs-32
     These options specify that the output generated by the assembler should be marked as supporting the indicated version of the Arm Procedure. Calling Standard.

-matpcs
     This option specifies that the output generated by the assembler should be marked as supporting the Arm/Thumb Procedure Calling Standard.  If enabled this option will cause the assembler to create an empty debugging section in the object file called .arm.atpcs.  Debuggers can use this to determine the ABI being used by.

-mapcs-float
     This indicates the floating point variant of the APCS should be used.  In this variant floating point arguments are passed in FP registers rather than integer registers.

-mapcs-reentrant
     This indicates that the reentrant variant of the APCS should be used. This variant supports position independent code.

-mfloat-abi=ABI
     This option specifies that the output generated by the assembler should be marked as using specified floating point ABI. The following values are recognized: soft, softfp and hard.

-meabi=VER
     This option specifies which EABI version the produced object files should conform to. The following values are recognized: gnu, 4 and 5.

-EB
     This option specifies that the output generated by the assembler should be marked as being encoded for a big-endian processor.

-EL
     This option specifies that the output generated by the assembler should be marked as being encoded for a little-endian processor.

-k
     This option specifies that the output of the assembler should be marked as position-independent code (PIC).

--fix-v4bx
     Allow BX instructions in ARMv4 code.  This is intended for use with the linker option of the same name.

-mwarn-deprecated
-mno-warn-deprecated
     Enable or disable warnings about using deprecated options or features.  The default is to warn.

Syntax
======

Instruction Set Syntax
----------------------

Two slightly different syntaxes are support for ARM and THUMB instructions.  The default, divided, uses the old style where ARM and THUMB instructions had their own, separate syntaxes.  The new, unified syntax, which can be selected via the .syntax directive, and has the following main features:

     Immediate operands do not require a # prefix.

     The IT instruction may appear, and if it does it is validated against subsequent conditional affixes.  In ARM mode it does not generate machine code, in THUMB mode it does.

     For ARM instructions the conditional affixes always appear at the end of the instruction.  For THUMB instructions conditional affixes can be used, but only inside the scope of an IT instruction.

     All of the instructions new to the V6T2 architecture (and later) are available.  (Only a few such instructions can be written in the divided syntax).

     The .N and .W suffixes are recognized and honored.

     All instructions set the flags if and only if they have an s affix.

Special Characters
------------------

The presence of a @ on a line indicates the start of a comment that extends to the end of the current line.  If a # appears as the first character of a line, the whole line is treated as a comment.

The ; character can be used instead of a newline to separate statements.

Either # or $ can be used to indicate immediate operands.

*TODO* Explain about /data modifier on symbols.

Register Names
--------------

*TODO* Explain about ARM register naming, and the predefined names.

NEON Alignment Specifiers
-------------------------

Some NEON load/store instructions allow an optional address alignment qualifier. The ARM documentation specifies that this is indicated by @ ALIGN. However GAS already interprets the @ character as a "line comment" start, so : ALIGN is used instead.  For example:

             vld1.8 {q0}, [r0, :128]

Floating Point
==============

The ARM family uses IEEE floating-point numbers.

ARM relocation generation
-------------------------

Specific data relocations can be generated by putting the relocation name in parentheses after the symbol name.  For example:

             .word foo(TARGET1)

This will generate an R_ARM_TARGET1 relocation against the symbol FOO. The following relocations are supported: GOT, GOTOFF, TARGET1, TARGET2, SBREL, TLSGD, TLSLDM, TLSLDO, GOTTPOFF, GOT_PREL and TPOFF.

For compatibility with older toolchains the assembler also accepts (PLT) after branch targets.  This will generate the deprecated R_ARM_PLT32 relocation.

Relocations for MOVW and MOVT instructions can be generated by prefixing the value with #:lower16: and #:upper16 respectively.  For example to load the 32-bit address of foo into r0:

             MOVW r0, #:lower16:foo
             MOVT r0, #:upper16:foo

ARM Machine Directives
======================

.2byte EXPRESSION [, EXPRESSION]*
.4byte EXPRESSION [, EXPRESSION]*
.8byte EXPRESSION [, EXPRESSION]*
     These directives write 2, 4 or 8 byte values to the output section.

.align EXPRESSION [, EXPRESSION]
     This is the generic .ALIGN directive.  For the ARM however if the first argument is zero (ie no alignment is needed) the assembler will behave as if the argument had been 2 (ie pad to the next four byte boundary).  This is for compatibility with ARM's own assembler.

.arch NAME
     Select the target architecture.  Valid values for NAME are the same as for the -march commandline option.

.arm
     This performs the same action as .CODE 32.

.pad #COUNT
     Generate unwinder annotations for a stack adjustment of COUNT bytes. A positive value indicates the function prologue allocated stack space by decrementing the stack pointer.

.bss
     This directive switches to the .bss section.

.cantunwind
     Prevents unwinding through the current function.  No personality routine or exception table data is required or permitted.

.code [16|32]
     This directive selects the instruction set being generated. The value 16 selects Thumb, with the value 32 selecting ARM.

.cpu NAME
     Select the target processor.  Valid values for NAME are the same as for the -mcpu commandline option.

NAME .dn REGISTER NAME [.TYPE] [[INDEX]]

NAME .qn REGISTER NAME [.TYPE] [[INDEX]]

     The dn and qn directives are used to create typed and/or indexed register aliases for use in Advanced SIMD Extension (Neon) instructions.  The former should be used to create aliases of double-precision registers, and the latter to create aliases of quad-precision registers.

     If these directives are used to create typed aliases, those aliases can be used in Neon instructions instead of writing types after the mnemonic or after each operand.  For example:

                  x .dn d2.f32
                  y .dn d3.f32
                  z .dn d4.f32[1]
                  vmul x,y,z

     This is equivalent to writing the following:

                  vmul.f32 d2,d3,d4[1]

     Aliases created using dn or qn can be destroyed using unreq.

.eabi_attribute TAG, VALUE
     Set the EABI object attribute TAG to VALUE.

     The TAG is either an attribute number, or one of the following: Tag_CPU_raw_name, Tag_CPU_name, Tag_CPU_arch, Tag_CPU_arch_profile, Tag_ARM_ISA_use, Tag_THUMB_ISA_use, Tag_VFP_arch, Tag_WMMX_arch, Tag_Advanced_SIMD_arch, Tag_PCS_config, Tag_ABI_PCS_R9_use, Tag_ABI_PCS_RW_data, Tag_ABI_PCS_RO_data, Tag_ABI_PCS_GOT_use, Tag_ABI_PCS_wchar_t, Tag_ABI_FP_rounding, Tag_ABI_FP_denormal, Tag_ABI_FP_exceptions, Tag_ABI_FP_user_exceptions, Tag_ABI_FP_number_model, Tag_ABI_align8_needed, Tag_ABI_align8_preserved, Tag_ABI_enum_size, Tag_ABI_HardFP_use, Tag_ABI_VFP_args, Tag_ABI_WMMX_args, Tag_ABI_optimization_goals, Tag_ABI_FP_optimization_goals, Tag_compatibility, Tag_CPU_unaligned_access, Tag_VFP_HP_extension, Tag_ABI_FP_16bit_format, Tag_MPextension_use, Tag_DIV_use, Tag_nodefaults, Tag_also_compatible_with, Tag_conformance, Tag_T2EE_use, Tag_Virtualization_use

     The VALUE is either a number, "string", or number, "string" depending on the tag.

.even
     This directive aligns to an even-numbered address.

.extend  EXPRESSION [, EXPRESSION]*
.ldouble  EXPRESSION [, EXPRESSION]*
     These directives write 12byte long double floating-point values to the output section.  These are not compatible with current ARM processors or ABIs.

.fnend
     Marks the end of a function with an unwind table entry.  The unwind index table entry is created when this directive is processed.

     If no personality routine has been specified then standard personality routine 0 or 1 will be used, depending on the number of unwind opcodes required.

.fnstart
     Marks the start of a function with an unwind table entry.

.force_thumb
     This directive forces the selection of Thumb instructions, even if the target processor does not support those instructions

.fpu NAME
     Select the floating-point unit to assemble for.  Valid values for NAME are the same as for the -mfpu commandline option.

.handlerdata
     Marks the end of the current function, and the start of the exception table entry for that function.  Anything between this directive and the .fnend directive will be added to the exception table entry.

     Must be preceded by a .personality or .personalityindex directive.

.inst OPCODE [ , ... ]

.inst.n OPCODE [ , ... ]

.inst.w OPCODE [ , ... ]
     Generates the instruction corresponding to the numerical value OPCODE. .inst.n and .inst.w allow the Thumb instruction size to be specified explicitly, overriding the normal encoding rules.

.ldouble  EXPRESSION [, EXPRESSION]*
     See .extend.

.ltorg
     This directive causes the current contents of the literal pool to be dumped into the current section (which is assumed to be the .text section) at the current location (aligned to a word boundary). GAS maintains a separate literal pool for each section and each sub-section.  The .ltorg directive will only affect the literal pool of the current section and sub-section.  At the end of assembly all remaining, un-empty literal pools will automatically be dumped.

     Note - older versions of GAS would dump the current literal pool any time a section change occurred.  This is no longer done, since it prevents accurate control of the placement of literal pools.

.movsp REG [, #OFFSET]
     Tell the unwinder that REG contains an offset from the current stack pointer.  If OFFSET is not specified then it is assumed to be zero.

.object_arch NAME
     Override the architecture recorded in the EABI object attribute section. Valid values for NAME are the same as for the .arch directive. Typically this is useful when code uses runtime detection of CPU features.

.packed  EXPRESSION [, EXPRESSION]*
     This directive writes 12-byte packed floating-point values to the output section.  These are not compatible with current ARM processors or ABIs.

.pad #COUNT
     Generate unwinder annotations for a stack adjustment of COUNT bytes. A positive value indicates the function prologue allocated stack space by decrementing the stack pointer.

.personality NAME
     Sets the personality routine for the current function to NAME.

.personalityindex INDEX
     Sets the personality routine for the current function to the EABI standard routine number INDEX

.pool
     This is a synonym for .ltorg.

NAME .req REGISTER NAME
     This creates an alias for REGISTER NAME called NAME.  For example:

                  foo .req r0

.save REGLIST
     Generate unwinder annotations to restore the registers in REGLIST. The format of REGLIST is the same as the corresponding store-multiple instruction.

          core registers
            .save {r4, r5, r6, lr}
            stmfd sp!, {r4, r5, r6, lr}
          FPA registers
            .save f4, 2
            sfmfd f4, 2, [sp]!
          VFP registers
            .save {d8, d9, d10}
            fstmdx sp!, {d8, d9, d10}
          iWMMXt registers
            .save {wr10, wr11}
            wstrd wr11, [sp, #-8]!
            wstrd wr10, [sp, #-8]!
          or
            .save wr11
            wstrd wr11, [sp, #-8]!
            .save wr10
            wstrd wr10, [sp, #-8]!

.setfp FPREG, SPREG [, #OFFSET]
     Make all unwinder annotations relative to a frame pointer.  Without this the unwinder will use offsets from the stack pointer.

     The syntax of this directive is the same as the sub or mov instruction used to set the frame pointer.  SPREG must be either sp or mentioned in a previous .movsp directive.

          .movsp ip
          mov ip, sp
          ...
          .setfp fp, ip, #4
          sub fp, ip, #4

.secrel32 EXPRESSION [, EXPRESSION]*
     This directive emits relocations that evaluate to the section-relative offset of each expression's symbol.  This directive is only supported for PE targets.

.syntax [unified | divided]
     This directive sets the Instruction Set Syntax as described in the ARM-Instruction-Set section.

.thumb
     This performs the same action as .CODE 16.

.thumb_func
     This directive specifies that the following symbol is the name of a Thumb encoded function.  This information is necessary in order to allow the assembler and linker to generate correct code for interworking between Arm and Thumb instructions and should be used even if interworking is not going to be performed.  The presence of this directive also implies .thumb

     This directive is not neccessary when generating EABI objects.  On these targets the encoding is implicit when generating Thumb code.

.thumb_set
     This performs the equivalent of a .set directive in that it creates a symbol which is an alias for another symbol (possibly not yet defined).  This directive also has the added property in that it marks the aliased symbol as being a thumb function entry point, in the same way that the .thumb_func directive does.

.unreq ALIAS-NAME
     This undefines a register alias which was previously defined using the req, dn or qn directives.  For example:

                  foo .req r0
                  .unreq foo

     An error occurs if the name is undefined.  Note - this pseudo op can be used to delete builtin in register name aliases (eg 'r0').  This should only be done if it is really necessary.

.unwind_raw OFFSET, BYTE1, ...
     Insert one of more arbitary unwind opcode bytes, which are known to adjust the stack pointer by OFFSET bytes.

     For example .unwind_raw 4, 0xb1, 0x01 is equivalent to .save {r0}

.vsave VFP-REGLIST
     Generate unwinder annotations to restore the VFP registers in VFP-REGLIST using FLDMD.  Also works for VFPv3 registers that are to be restored using VLDM. The format of VFP-REGLIST is the same as the corresponding store-multiple instruction.

          VFP registers
            .vsave {d8, d9, d10}
            fstmdd sp!, {d8, d9, d10}
          VFPv3 registers
            .vsave {d15, d16, d17}
            vstm sp!, {d15, d16, d17}

     Since FLDMX and FSTMX are now deprecated, this directive should be used in favour of .save for saving VFP registers for ARMv6 and above.

Opcodes
=======

AS implements all the standard ARM opcodes.  It also implements several pseudo opcodes, including several synthetic load instructions.

NOP

            nop

     This pseudo op will always evaluate to a legal ARM instruction that does nothing.  Currently it will evaluate to MOV r0, r0.

LDR

            ldr <register> , = <expression>

     If expression evaluates to a numeric constant then a MOV or MVN instruction will be used in place of the LDR instruction, if the constant can be generated by either of these instructions.  Otherwise the constant will be placed into the nearest literal pool (if it not already there) and a PC relative LDR instruction will be generated.

ADR

            adr <register> <label>

     This instruction will load the address of LABEL into the indicated register.  The instruction will evaluate to a PC relative ADD or SUB instruction depending upon where the label is located.  If the label is out of range, or if it is not defined in the same file (and section) as the ADR instruction, then an error will be generated.  This instruction will not make use of the literal pool.

ADRL

            adrl <register> <label>

     This instruction will load the address of LABEL into the indicated register.  The instruction will evaluate to one or two PC relative ADD or SUB instructions depending upon where the label is located.  If a second instruction is not needed a NOP instruction will be generated in its place, so that this instruction is always 8 bytes long.

     If the label is out of range, or if it is not defined in the same file (and section) as the ADRL instruction, then an error will be generated. This instruction will not make use of the literal pool.

For information on the ARM or Thumb instruction sets, see ARM Software Development Toolkit Reference Manual, Advanced RISC Machines Ltd.

Mapping Symbols
===============

The ARM ELF specification requires that special symbols be inserted into object files to mark certain features:

$a
     At the start of a region of code containing ARM instructions.

$t
     At the start of a region of code containing THUMB instructions.

$d
     At the start of a region of data.

The assembler will automatically insert these symbols for you - there is no need to code them yourself.  Support for tagging symbols ($b, $f, $p and $m) which is also mentioned in the current ARM ELF specification is not implemented.  This is because they have been dropped from the new EABI and so tools cannot rely upon their presence.

Unwinding
=========

The ABI for the ARM Architecture specifies a standard format for exception unwind information.  This information is used when an exception is thrown to determine where control should be transferred. In particular, the unwind information is used to determine which function called the function that threw the exception, and which function called that one, and so forth.  This information is also used to restore the values of callee-saved registers in the function catching the exception.

If you are writing functions in assembly code, and those functions call other functions that throw exceptions, you must use assembly pseudo ops to ensure that appropriate exception unwind information is generated.  Otherwise, if one of the functions called by your assembly code throws an exception, the run-time library will be unable to unwind the stack through your assembly code and your program will not behave correctly.

To illustrate the use of these pseudo ops, we will examine the code that G++ generates for the following C++ input:

void callee (int *);

int
caller ()
{
  int i;
  callee (&i);
  return i;
}

This example does not show how to throw or catch an exception from assembly code.  That is a much more complex operation and should always be done in a high-level language, such as C++, that directly supports exceptions.

The code generated by one particular version of G++ when compiling the example above is:

_Z6callerv:
	.fnstart
.LFB2:
	@ Function supports interworking.
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	stmfd	sp!, {fp, lr}
	.save {fp, lr}
.LCFI0:
	.setfp fp, sp, #4
	add	fp, sp, #4
.LCFI1:
	.pad #8
	sub	sp, sp, #8
.LCFI2:
	sub	r3, fp, #8
	mov	r0, r3
	bl	_Z6calleePi
	ldr	r3, [fp, #-8]
	mov	r0, r3
	sub	sp, fp, #4
	ldmfd	sp!, {fp, lr}
	bx	lr
.LFE2:
	.fnend

Of course, the sequence of instructions varies based on the options you pass to GCC and on the version of GCC in use.  The exact instructions are not important since we are focusing on the pseudo ops that are used to generate unwind information.

An important assumption made by the unwinder is that the stack frame does not change during the body of the function.  In particular, since we assume that the assembly code does not itself throw an exception, the only point where an exception can be thrown is from a call, such as the bl instruction above.  At each call site, the same saved registers (including lr, which indicates the return address) must be located in the same locations relative to the frame pointer.

The .fnstart (see .fnstart pseudo op) pseudo op appears immediately before the first instruction of the function while the .fnend (see .fnend pseudo op) pseudo op appears immediately after the last instruction of the function. These pseudo ops specify the range of the function.

Only the order of the other pseudos ops (e.g., .setfp or .pad) matters; their exact locations are irrelevant.  In the example above, the compiler emits the pseudo ops with particular instructions.  That makes it easier to understand the code, but it is not required for correctness.  It would work just as well to emit all of the pseudo ops other than .fnend in the same order, but immediately after .fnstart.

The .save (see .save pseudo op) pseudo op indicates registers that have been saved to the stack so that they can be restored before the function returns.  The argument to the .save pseudo op is a list of registers to save.  If a register is ``callee-saved'' (as specified by the ABI) and is modified by the function you are writing, then your code must save the value before it is modified and restore the original value before the function returns.  If an exception is thrown, the run-time library restores the values of these registers from their locations on the stack before returning control to the exception handler.  (Of course, if an exception is not thrown, the function that contains the .save pseudo op restores these registers in the function epilogue, as is done with the ldmfd instruction above.)

You do not have to save callee-saved registers at the very beginning of the function and you do not need to use the .save pseudo op immediately following the point at which the registers are saved. However, if you modify a callee-saved register, you must save it on the stack before modifying it and before calling any functions which might throw an exception.  And, you must use the .save pseudo op to indicate that you have done so.

The .pad (see .pad) pseudo op indicates a modification of the stack pointer that does not save any registers. The argument is the number of bytes (in decimal) that are subtracted from the stack pointer.  (On ARM CPUs, the stack grows downwards, so subtracting from the stack pointer increases the size of the stack.)

The .setfp (see .setfp pseudo op) pseudo op indicates the register that contains the frame pointer.  The first argument is the register that is set, which is typically fp. The second argument indicates the register from which the frame pointer takes its value.  The third argument, if present, is the value (in decimal) added to the register specified by the second argument to compute the value of the frame pointer.  You should not modify the frame pointer in the body of the function.

If you do not use a frame pointer, then you should not use the .setfp pseudo op.  If you do not use a frame pointer, then you should avoid modifying the stack pointer outside of the function prologue.  Otherwise, the run-time library will be unable to find saved registers when it is unwinding the stack.

The pseudo ops described above are sufficient for writing assembly code that calls functions which may throw exceptions.  If you need to know more about the object-file format used to represent unwind information, you may consult the Exception Handling ABI for the ARM Architecture available from http://infocenter.arm.com.