Session 11

1. Session 11 Exception Handling & Thumb State

2. Objectives • To understand different operating modes of ARM Processor. • To understand how exceptions are handled in ARM Processor and how to return from exception • To know exception priority and vector addresses. • To learn direct manipulation of status registers. • To understand branch instruction, subroutine handling and changing between ARM and THUMB mode with branching. • To learn how high-level constructs like if, switch and for statements can be implemented in ARM assembly code.

3. Objectives • To understand 16-bit Thumb mode operation of ARM Processor. • To understand the features of Thumb mode operation and how Thumb instructions decompress to ARM Mode. • To know the technique of switching between ARM and Thumb mode of operations. • To know the similarities and differences between ARM and Thumb mode of operation • To understand exception handling and branching in Thumb mode. • To understand operation of data processing instructions and data transfer instructions in Thumb mode.

4. ARM Exceptions Exceptions are used to handle unexpected events which arise • due to external interrupts • due to execution of program ARM Exceptions Classification • Exception generated as direct effect of instruction execution • SWI, Undefined, prefetch aborts • Exception generated as a side-effect of an instruction • Data aborts • Exception generated externally, unrelated to program execution • Reset, IRQ and FIQ

5. Processor Modes • The ARM has six operating modes: • User (unprivileged mode under which most tasks run) • Fast interrupt request Mode-FIQ (entered when a high priority (fast) interrupt is raised) • Interrupt Mode-IRQ (entered when a low priority (normal) interrupt is raised) • Supervisor Mode-SVC (entered on reset and when a Software Interrupt instruction is executed) • Abort Mode- ABT (used to handle memory access violations) • Undefined Mode-UND(used to handle undefined instructions) • ARM Architecture Version 4 adds a seventh mode: • System Mode-SYS (privileged mode using the same registers as user mode)

6. Processor Modes • All modes except User mode are referred to as privileged modes. They have full access to system resources and can change mode freely. • Modes other than User mode are entered to service exceptions, or to access privileged resources. Five of them are known as Exception modes: • IRQ, FIQ, Supervisor, Abort, Undefined Modes • Applications that require task protection usually execute in User mode. • Some embedded applications might run entirely in Supervisor or System modes. It is intended for use by Operating system with the Exception Mode.

7. Operating modes

8. The Current Program Status Register(CPSR) • The CPSR holds: • copies of the Arithmetic Logic Unit (ALU) status flags • the current processor mode • interrupt disable flags. • The ALU status flags in the CPSR are used to determine whether conditional instructions are executed or not. • On Thumb-capable processors, the CPSR also holds the current processor state (ARM or Thumb).

9. ARM General registers and Program Counter User32 / System FIQ32 Supervisor32 Abort32 IRQ32 Undefined32 r0 r0 r0 r0 r0 r0 r1 r1 r1 r1 r1 r1 r2 r2 r2 r2 r2 r2 r3 r3 r3 r3 r3 r3 r4 r4 r4 r4 r4 r4 r5 r5 r5 r5 r5 r5 r6 r6 r6 r6 r6 r6 r7 r7 r7 r7 r7 r7 r8 r8_fiq r8 r8 r8 r8 r9 r9_fiq r9 r9 r9 r9 r10_fiq r10 r10 r10 r10 r10 r11 r11_fiq r11 r11 r11 r11 r12_fiq r12 r12 r12 r12 r12 r13 (sp) r13_fiq r13_svc r13_abt r13_irq r13_undef r14 (lr) r14_fiq r14_svc r14_abt r14_irq r14_undef r15 (pc) r15 (pc) r15 (pc) r15 (pc) r15 (pc) r15 (pc) ARM Program Status Registers cpsr cpsr cpsr cpsr cpsr cpsr sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq spsr_fiq spsr_svc spsr_abt sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq spsr_irq spsr_undef sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq ARM Register Organisation * Shaded indicates Banked Registers

10. Thumb General registers and Program Counter User / System FIQ Supervisor Abort IRQ Undefined r0 r0 r0 r0 r0 r0 r1 r1 r1 r1 r1 r1 r2 r2 r2 r2 r2 r2 r3 r3 r3 r3 r3 r3 r4 r4 r4 r4 r4 r4 r5 r5 r5 r5 r5 r5 r6 r6 r6 r6 r6 r6 r7 r7 r7 r7 r7 r7 SP_SVC SP_ABT SP_IRQ SP_UND SP_FIQ SP LR_ ABT LR_ IRQ LR_ SVC LR_ FIQ LR_ UND LR PC_ UND PC_ SVC PC_ IRQ PC_ FIQ PC_ ABT PC Thumb Program Status Registers sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq SPSR_FIQ SPSR_SVC SPSR_ABT CPSR CPSR CPSR CPSR CPSR CPSR sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq SPSR_IRQ SPSR _UND sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq sprsr_fiq THUMB Register Organisation

11. Exception Handling • When an exception occurs, the core: • Copies CPSR into SPSR_<mode> • Sets appropriate CPSR bits • If core implements ARM Architecture 4T and is currently in Thumb state, then • ARM state is entered. • Mode field bits are changed to indicate new mode. • Disables IRQ and in case of FIQ disables further fast interrupts. • Maps in appropriate banked registers • Stores the “return address” in LR_<mode> • Sets PC to vector address

12. Exception Handling • To return, exception handler needs to: • Restore CPSR from SPSR_<mode> • Restore PC from LR_<mode> • Above two operations cannot be carried out simultaneously. • If CPSR is restored first – mode gets changed – r14 is no longer accessible. • If PC is restored first – exception handler looses control and cannot do restoration of CPSR.

13. With return address in R14 • To return from a SWI or undefined instruction trap use: • MOVS PC, R14 • To return from an IRQ, FIQ or prefetch abort use: • SUBS PC, R14, #4 • To return from a data abort to retry the data access use: • SUBS PC, R14, #8

14. Adjustment to return address • IRQ and FIQ must return one instruction early in order to execute the instruction that was “usurped” for the exception entry. • Prefetch abort must return one instruction early to execute the instruction that had caused a memory fault when first requested. • Data abort must return two instructions early to retry the data transfer instruction, which was the instruction before the one usurped for exception entry.

15. Return address in Stack • Handler can save all registers along with return address on to stack STMFD sp!,{r0-r12, lr} ; stack all registers ........ ; and the return address ........ • In that case the restoration of user registers and PC can be implemented with a single multiple register transfer instruction such as: LDMFD sp!,{r0-r12, pc}^ ; load all the registers ; and return automatically • However in order to adjust the return mechanism r14 must be adjusted before being saved onto the stack.

16. Exception Vector Table

17. Exception Priority • When multiple exception arise at same time the following priority order is followed. • Reset • Data abort • FIQ • IRQ • Prefetch abort • SWI , Undefined

18. FIQ MODE • supports data transfer or channel process. • externally generated by taking the nFIQ input LOW. • FIQ may be disabled by setting the CPSR’s F flag IRQ MODE • IRQ has a lower priority than FIQ. • disabled at any time by setting the I bit in the CPSR.

19. ABORT MODE • indicates that the current memory access cannot be completed. • There are two types of abort: Prefetch abort -occurs during an instruction prefetch. Data abort -occurs during a data access. The exception will not be taken until the instruction reaches the head of the pipeline.

20. Supervisor Mode • The Supervisor Mode is entered in following situations. • Power on Reset • On reset • When SWI (Software Interrupt) instruction is executed

21. UNDEFINED MODE • used to extend either the THUMB or ARM instruction set by software emulation. • After emulating the failed instruction, the trap handler- restores the CPSR and returns to the instruction following the undefined instruction.

22. 28 4 0 31 8 Z C V N I F T Mode Copies of the ALU status flags (latched if the instruction has the "S" bit set). Condition bits The Program Status Registers (CPSR and SPSRs) • * Condition Code Flags • N = Negative result from ALU flag. • Z = Zero result from ALU flag. • C = ALU operation Carried out • V = ALU operation oVerflowed • * Mode Bits • M[4:0] define the processor mode. * Interrupt Disable bits. I = 1, disables the IRQ. F = 1, disables the FIQ. * T Bit (Architecture v4T only) T = 0, Processor in ARM state T = 1, Processor in Thumb state

23. Condition Flags

24. PSR Transfer Instructions • MRS and MSR allow contents of CPSR/SPSR to be transferred from appropriate status register to a general purpose register. • All of status register, or just the flags, can be transferred. • Syntax: • MRS{<cond>} Rd,<psr> ; Rd = <psr> • MSR{<cond>} <psr>,Rm ; <psr> = Rm • MSR{<cond>} <psrf>,Rm ; <psrf> = Rm where • <psr> = CPSR, CPSR_all, SPSR or SPSR_all • <psrf> = CPSR_flg or SPSR_flg • Also an immediate form • MSR{<cond>} <psrf>,#Immediate • This immediate must be a 32-bit immediate, of which the 4 most significant bits are written to the flag bits.

25. 28 4 0 31 8 I F T N Z C V Mode Using MRS and MSR • Currently reserved bits, may be used in future, therefore: • they must be preserved when altering PSR • the value they return must not be relied upon when testing other bits. • Thus read-modify-write strategy must be followed when modifying any PSR: • Transfer PSR to register using MRS • Modify relevant bits • Transfer updated value back to PSR using MSR • Note: • In User Mode, all bits can be read but only the flag bits can be written to.

26. PSR Bit Sections Format: MSR {<cond>} CPSR_f |SPSR_f, Rm|immediate _f could be f, s, e, c which apply field mask Note: status field and extension fields are unused on current ARMs. 31 28 25 24 16 15 8 7 5 0 N Z C V I F T mode flags field (f) status field (s) extension field (e) control field(c)

27. Conditional Execution • Most instruction sets only allow branches to be executed conditionally. • However by reusing the condition evaluation hardware, ARM effectively increases number of instructions. • All instructions contain a condition field which determines whether the CPU will execute them. • Non-executed instructions soak up 1 cycle. • Still have to complete cycle so as to allow fetching and decoding of following instructions. • This removes the need for many branches, which stall the pipeline (3 cycles to refill). • Allows very dense in-line code, without branches. • The Time penalty of not executing several conditional instructions is frequently less than overhead of the branch or subroutine call that would otherwise be needed.

28. 28 24 20 16 4 0 31 12 8 Cond The Condition Field 1001 = LS - C clear or Z (set unsigned lower or same) 1010 = GE - N set and V set, or N clear and V clear (>or =) 1011 = LT - N set and V clear, or N clear and V set (>) 1100 = GT - Z clear, and either N set and V set, or N clear and V set (>) 1101 = LE - Z set, or N set and V clear,or N clear and V set (<, or =) 1110 = AL - always 1111 = NV - reserved. 0000 = EQ - Z set (equal) 0001 = NE - Z clear (not equal) 0010 = HS / CS - C set (unsigned higher or same) 0011 = LO / CC - C clear (unsigned lower) 0100 = MI -N set (negative) 0101 = PL - N clear (positive or zero) 0110 = VS - V set (overflow) 0111 = VC - V clear (no overflow) 1000 = HI - C set and Z clear (unsigned higher)

29. 31 28 27 25 24 23 0 Cond 1 0 1 L Offset Link bit 0 = Branch 1 = Branch with link Condition field Branch instructions • Branch : B{<cond>} label • Branch with Link : BL{<cond>} sub_routine_label • The offset for branch instructions is calculated by the assembler: • By taking the difference between the branch instruction and the target address minus 8 (to allow for the pipeline). • This gives a 26 bit offset which is right shifted 2 bits (as the bottom two bits are always zero as instructions are word – aligned) and stored into the instruction encoding. • This gives a range of ± 32 Mbytes.

30. Branch instructions • When executing the instruction, the processor: • shifts the offset left two bits, sign extends it to 32 bits, and adds it to PC. • Execution then continues from the new PC, once the pipeline has been refilled. • The "Branch with link" instruction implements a subroutine call by writing PC-4 into the LR of the current bank. • i.e. the address of the next instruction following the branch with link (allowing for the pipeline). • To return from subroutine, simply need to restore the PC from the LR: • MOV pc, lr • Again, pipeline has to refill before execution continues. • The "Branch" instruction does not affect LR. • Note: Architecture 4T offers a further ARM branch instruction, BX

31. BX Instruction BX : Branch and Exchange Instruction branches to an address held in register Rm with an optional switch to Thumb execution. Branch target address is the value of register Rm, with bit[0] forced to zero Mode of branch target is chosen by setting the CPSR T bit to bit[0] of ARM. Syntax: BX { <cond>} <Rm>

32. BX Instruction SBO : Should be 0 (Zero) Only Rm : Register [31 : 1] which will be transferred to PC. It is essential that the address should be word aligned. 31 28 27 20 19 16 15 12 11 8 7 4 3 0 Cond 0 0 0 1 0 0 1 0 SBO SBO SBO 0 0 0 1 Rm

33. Example: if statement • C: if (a > b) { x = 5; y = c + d; } else x = c - d; • Assembler: ; compute and test condition ADR r4,a ; get address for a LDR r0,[r4] ; get value of a ADR r4,b ; get address for b LDR r1,[r4] ; get value for b CMP r0,r1 ; compare a < b BGE fblock ; if a >= b, branch to false block

34. If statement, cont’d. ; true block MOV r0,#5 ; generate value for x ADR r4,x ; get address for x STR r0,[r4] ; store x ADR r4,c ; get address for c LDR r0,[r4] ; get value of c ADR r4,d ; get address for d LDR r1,[r4] ; get value of d ADD r0,r0,r1 ; compute y ADR r4,y ; get address for y STR r0,[r4] ; store y B after ; branch around false block

35. If statement, cont’d. ; false block fblock ADR r4,c ; get address for c LDR r0,[r4] ; get value of c ADR r4,d ; get address for d LDR r1,[r4] ; get value for d SUB r0,r0,r1 ; compute a-b ADR r4,x ; get address for x STR r0,[r4] ; store value of x after ...

36. Example: Conditional instruction implementation ; true block MOVLT r0,#5 ; generate value for x ADRLT r4,x ; get address for x STRLT r0,[r4] ; store x ADRLT r4,c ; get address for c LDRLT r0,[r4] ; get value of c ADRLT r4,d ; get address for d LDRLT r1,[r4] ; get value of d ADDLT r0,r0,r1 ; compute y ADRLT r4,y ; get address for y STRLT r0,[r4] ; store y

37. Conditional instruction implementation, cont’d. ; false block ADRGE r4,c ; get address for c LDRGE r0,[r4] ; get value of c ADRGE r4,d ; get address for d LDRGE r1,[r4] ; get value for d SUBGE r0,r0,r1 ; compute a-b ADRGE r4,x ; get address for x STRGE r0,[r4] ; store value of x

38. Example: switch statement • C: switch (test) { case 0: … break; case 1: … } • Assembler: ADR r2,test ; get address for test LDR r0,[r2] ; load value for test ADR r1,switchtab ; load address for switch table LDR r1,[r1,r0,LSL #2] ; index switch table switchtab DCD case0 DCD case1 ...

39. Subroutine calling AREA Example, CODE, READONLY ; name this blk of code ENTRY ; mark I instruction to execute start MOV r0, #15 ; Set up parameters MOV r1, #20 BL firstfunc ; Call subroutine SWI 0x11 ; terminate firstfunc ; Subroutine firstfunc ADD r0, r0, r1 ; r0 = r0 + r1 MOV pc, lr ; Return from subroutine ; with result in r0 END ; mark end of file

40. Nested subroutine calls • Nesting/recursion requires coding convention: f1 LDR r0,[r13], #4 ; load arg into r0 from stack ; call f2() STR r14, [r13], # -4; store f1’s return adrs STR r0, [r13], # -4 ; store arg to f2 on stack BL f2 ; branch and link to f2 ; return from f1() SUB r13, r13, #4 ; pop f2’s arg off stack LDR r15, [r13], # 4 ; restore register and return

41. Switch statement with subroutines AREA ArithGate, CODE ; name this block of code ENTRY ; mark the first instruction to call main MOV r0, #2 ; set up three parameters MOV r1, #5 MOV r2, #15 BL arithfunc ; call the function SWI 0x11 ; terminate arithfunc ; label the function CMP r0, #4 ; Treat code as unsigned integer BHI ReturnA1 ; If code > 4 then return first argument ADR r3, JumpTable ; Load address of the jump table LDR pc,[r3,r0,LSL #2] ; Jump to appropriate routine JumpTable DCD ReturnA1 DCD ReturnA2 DCD DoAdd DCD DoSub DCD DoRsb

42. Continued….. ReturnA1 MOV r0, r1 ; Operation 0, >4 MOV pc,lr ReturnA2 MOV r0, r2 ; Operation 1 MOV pc,lr DoAdd ADD r0, r1, r2 ; Operation 2 MOV pc,lr DoSub SUB r0, r1, r2 ; Operation 3 MOV pc,lr DoRsb RSB r0, r1, r2 ; Operation 4 MOV pc,lr END ; mark the end of this file

43. Summary • 7 operating modes: User, FIQ, IRQ, SVC, ABT, UND, SYS • Mode indications in CPSR/SPSR: CPSR[4:0] • Exception handling in ARM Processor: LR, Stack, Vector addresses, Priority • Working with CPSR/SPSR: MSR, MRS • 16 Conditional execution on all instructions • Branch Instruction: B, BL • Branch with mode change: BX • Implementation of high level constructs

44. CPU Instruction Set • ARM7TDMI processor has two instruction sets: • the standard 32-bit ARM set • a 16-bit THUMB set.

45. Processor Operating States • ARM state which executes 32-bit, word-aligned ARM instructions. • THUMB state which operates with 16-bit, halfword-aligned THUMB instructions.

46. Thumb Instruction Set • ARM architecture versions v4T and above define a 16-bit instruction set called the Thumb instruction set. The functionality of the Thumb instruction set is a subset of the functionality of the 32-bit ARM instruction set. • A processor that is executing Thumb instructions is operating in Thumb state. A processor that is executing ARM instructions is operating in ARM state.

47. Thumb Instruction Set • A processor in ARM state cannot execute Thumb instructions, and a processor in Thumb state cannot execute ARM instructions. You must ensure that the processor never receives instructions of the wrong instruction set for the current state. • Each instruction set includes instructions to change processor state. Note: ARM processors always start executing code in ARM state.

48. Thumb applications • In a typical embedded system: • use ARM code in 32-bit on-chip memory for small speed- critical routines • use Thumb code in 16-bit off-chip memory for large non-critical control routines Note: Switching between ARM and Thumb States of Execution Using BX Instruction

49. Thumb applications • For Most Instruction Generated by the Compiler • Condition Execution is not used. • Source and Destination Registers are identical • Only low registers used • Constants are limited size • Inline barrel shifter not used

50. DATA TYPES Byte (8-bit): placed on any byte boundary. Half-word (16-bit): aligned to two-byte boundaries. Word (32-bit): aligned to four- byte boundaries.