ldrht

Load Register Halfword Unprivileged

LDRHT<c> <Rt>, [<Rn>, #+/-<imm>]

Loads a halfword using User Mode permissions.

Details

Load Register Halfword Unprivileged loads an unsigned halfword (16 bits) from memory using unprivileged (User mode) permissions, regardless of the current privilege level, and writes it zero-extended to Rt. The address is computed from Rn plus a 12-bit signed immediate offset (formed from two 4-bit fields). Condition flags are unaffected. This instruction is available in A32/T32 and is commonly used for accessing user-mode memory from privileged code.

Pseudocode Operation

offset ← (imm4_upper << 4) | imm4_lower
address ← Rn + SignExtend(offset)
Rt ← ZeroExtend([address][15:0])
if W then Rn ← address

Example

LDRHT r3, [r1, #+/-#16]

Encoding

Binary Layout
cond
000
0
U
1
1
1
Rn
Rt
imm4H
1
01
1
imm4L
 
Format Load/Store
Opcode 0x007000B0
Extension A32 (Base)

Operands

  • Rt
    Transfer general-purpose register (load/store)
  • Rn
    First source / base general-purpose register
  • imm
    Signed immediate value

Reference (Arm AArch32 ISA)

Instruction Forms

Encoding Instruction ISA Bit pattern
0x007000B0 LDRHT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} A32 cond | 000 | 0 | U | 1 | 1 | 1 | Rn | Rt | imm4H | 1 | 01 | 1 | imm4L
0x003000B0 LDRHT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> A32 cond | 000 | 0 | U | 0 | 1 | 1 | Rn | Rt | 0 | 0 | 0 | 0 | 1 | 01 | 1 | Rm
0xF8300E00 LDRHT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] T32 111110000 | 01 | 1 | Rn | Rt | 1110 | imm8

Description

Load Register Halfword Unprivileged loads a halfword from memory, zero-extends it to form a 32-bit word, and writes it to a register. For information about memory accesses see Memory accesses. The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is actually running in User mode. LDRHT is unpredictable in Hyp mode. The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a base register value and an immediate offset, and leaves the base register unchanged. The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the memory access, and calculates a new address from a base register value and an offset and writes it back to the base register. The offset can be an immediate value or a register value.

Operation

if ConditionPassed() then
    EncodingSpecificOperations();
    if PSTATE.EL == EL2 then UNPREDICTABLE;               // Hyp mode
    offset = if register_form then R[m] else imm32;
    offset_addr = if add then (R[n] + offset) else (R[n] - offset);
    address = if postindex then R[n] else offset_addr;
    data = MemU_unpriv[address,2];
    if postindex then R[n] = offset_addr;
    R[t] = ZeroExtend(data, 32);