The 32 registers
The register file is r0 to r31, eight bits each. It is also the first 32 bytes of the data space. Some instructions can use only the upper half
(r16 to r31: LDI, CPI, SUBI, SBCI, ANDI, ORI, MULS), and the
reduced core (avrtiny) has only that half. Three register pairs work as 16-bit pointers:
| Pointer | Registers | Use |
|---|---|---|
X | r27:r26 | LD, ST with no displacement |
Y | r29:r28 | LD, ST, LDD, STD (the C frame pointer) |
Z | r31:r30 | LD, ST, LDD, STD, LPM, ELPM, SPM, IJMP, ICALL |
ADIW and SBIW add to and subtract from r25:r24, X, Y and Z; MOVW copies any even pair; MUL leaves its result in r1:r0.
The status register SREG
SREG is I/O register 0x3F (data address 0x5F). Its bits, from bit 7 down:
| Bit | Flag | Name |
|---|---|---|
| 7 | I | Global interrupt enable (SEI, CLI; RETI sets it) |
| 6 | T | Bit copy storage (BST, BLD) |
| 5 | H | Half carry (carry out of bit 3: for BCD) |
| 4 | S | Sign: N xor V, for signed comparisons |
| 3 | V | Two’s complement overflow |
| 2 | N | Negative |
| 1 | Z | Zero |
| 0 | C | Carry |
The viewer lists, for every instruction, the flags it changes and the flags it reads (ADC reads C, BRBS the flag it tests). IN and OUT of SREG read and write all eight.
The address spaces
| Space | Reached by | Contents |
|---|---|---|
| Program memory (flash) | PC, LPM, ELPM, SPM, IJMP, ICALL | Code and constant data, as 16-bit words. LPM reads one byte of it through Z (the low bit of Z picks the byte of the word). |
| Data space | LD, ST, LDD, STD, LDS, STS, PUSH, POP | 0x0000 to 0x001F the registers; 0x0020 to 0x005F the I/O registers; 0x0060 to 0x00FF extended I/O (on devices that have it); then SRAM. |
| I/O space | IN, OUT, SBI, CBI, SBIS, SBIC | 64 addresses, 0x00 to 0x3F, the same registers as data 0x20 to 0x5F. Only 0x00 to 0x1F can be tested and changed bit by bit (SBI, CBI, SBIS, SBIC). |
An I/O register therefore has two addresses: PORTB of the ATmega328P is I/O 0x05 for OUT and data 0x25 for STS. The I/O register names page lists them. The registers above data 0x5F exist only in the data space.
In an ELF file for an AVR the linker puts the data space at 0x800000 so that the two spaces have different addresses in one file; the code starts at 0.
Word addresses and byte addresses
The program counter counts words. JMP 0x0436 in the manual’s notation jumps to the instruction that starts at byte 0x086C of flash. The tools (avr-objdump, llvm, the HEX file) write byte addresses, so
the disassembler writes byte addresses by default and offers the manual’s word addresses as an option. Relative jumps count words too (RJMP k goes to PC + k + 1) and are shown as the absolute byte address they reach. Z in LPM and in data accesses is a byte address; Z in IJMP and ICALL is a word address.
Flash is up to 8 K words (16 KB) for the cores without JMP, up to 64 K words (128 KB) with it; ELPM and the register RAMPZ (I/O 0x3B) reach the half above 64 KB, and EIJMP, EICALL with EIND (I/O 0x3C) jump into it. The ATmega2560 has 128 K words and a 22-bit program counter: calls push three bytes.
The stack
The stack grows downward in the data space. SP is I/O 0x3D (low) and 0x3E (high; absent on devices with up to 256 bytes of RAM). PUSH stores at SP and then decrements it; POP increments it and then loads. CALL, RCALL, ICALL push the return address, a word address, low byte first (so in memory the high byte is at the lower address: the stack holds it big-endian); RET and RETI pop it. PUSH and POP are not on the core with no RAM (avr1), which keeps return addresses in a three-level hardware stack.
Not described
- The memory maps of individual devices (RAM size, where extended I/O ends) beyond the four devices’ register tables.
- The interrupt vector table: the first words of flash hold one
JMPorRJMPper vector, whose number and order depend on the device.