原创 ARM7TDMI CORE programmer's model

2.1 About the programmer’s model
The ARM7TDMI processor core implements ARM architecture v4T, which includes
the 32-bit ARM instruction set, and the 16-bit Thumb instruction set. The programmer’s
model is described in the ARM Architecture Reference Manual.

2.2 Processor operating states
The ARM7TDMI processor has two operating states:
ARM  32-bit, word-aligned ARM instructions are executed in this state.
Thumb  16-bit, halfword-aligned Thumb instructions are executed in this state.
In Thumb state, the Program Counter (PC) uses bit 1 to select between alternate
halfwords.
Note
 Transition between ARM and Thumb states does not affect the processor mode or the
register contents.

2.2.1 Switching state
The operating state of the ARM7TDMI core can be switched between ARM state and
Thumb state using the BX instruction. This is described in the ARM Architecture
Reference Manual.
All exception handling is entered in ARM state. If an exception occurs in Thumb state,
the processor reverts to ARM state. The transition back to Thumb state occurs
automatically on return. An exception handler can change to Thumb state but it must
return to ARM state to enable the exception handler to terminate correctly.

2.3 Memory formats
The ARM7TDMI processor views memory as a linear collection of bytes numbered in
ascending order from zero. For example:
* bytes zero to three hold the first stored word
* bytes four to seven hold the second stored word.
The ARM7TDMI processor is bi-endian and can treat words in memory as being stored
in either:
* Little-endian.
* Big-endian on page 2-5
Note
 Little-endian is traditionally the default format for ARM processors.
The endian format of a CPU dictates where the most significant byte or digits must be
placed in a word. Because numbers are calculated by the CPU starting with the least
significant digits, little-endian numbers are already set up for the processing order.
Endian configuration has no relevance unless data is stored as words and then accessed
in smaller sized quantities (halfwords or bytes).

2.3.1 Little-endian
In little-endian format, the lowest addressed byte in a word is considered the
least-significant byte of the word and the highest addressed byte is the most significant.
So the byte at address 0 of the memory system connects to data lines 7 through 0.
For a word-aligned address A, Figure2-1 shows how the word at address A, the
halfword at addresses A and A+2, and the bytes at addresses A, A+1, A+2, and A+3
map on to each other when the core is configured as little-endian.

2.3.2 Big-endian
In big-endian format, the ARM7TDMI processor stores the most significant byte of a
word at the lowest-numbered byte, and the least significant byte at the
highest-numbered byte. So the byte at address 0 of the memory system connects to data
lines 31 through 24.
For a word-aligned address A, Figure 2-2 shows how the word at address A, the
halfword at addresses A and A+2, and the bytes at addresses A, A+1, A+2, and A+3
map on to each other when the core is configured as big-endian.

2.4 Data types
The ARM7TDMI processor supports the following data types:
* words, 32-bit
* halfwords, 16-bit
* bytes, 8-bit.
You must align these as follows:
* word quantities must be aligned to four-byte boundaries
* halfword quantities must be aligned to two-byte boundaries
* byte quantities can be placed on any byte boundary.
Note
 Memory systems are expected to support all data types. In particular, the system must
support subword writes without corrupting neighboring bytes in that word.

2.5 Operating modes
The ARM7TDMI processor has seven modes of operation:
* User mode is the usual ARM program execution state, and is used for executing
most application programs.
* Fast Interrupt (FIQ) mode supports a data transfer or channel process.
* Interrupt (IRQ) mode is used for general-purpose interrupt handling.
* Supervisor mode is a protected mode for the operating system.
* Abort mode is entered after a data or instruction Prefetch Abort.
* System mode is a privileged user mode for the operating system.
Note
  You can only enter System mode from another privileged mode by modifying the
mode bit of the Current Program Status Register (CPSR).
* Undefined mode is entered when an undefined instruction is executed.
Modes other than User mode are collectively known as privileged modes. Privileged
modes are used to service interrupts or exceptions, or to access protected resources.

Mode Mode identifier
User usr
Fast interrupt fiq
Interrupt irq
Supervisor svc
Abort abt
System sys
Undefined und

2.6 Registers
The ARM7TDMI processor has a total of 37 registers:
* 31 general-purpose 32-bit registers
* 6 status registers.
These registers are not all accessible at the same time. The processor state and operating
mode determine which registers are available to the programmer.

2.6.1 The ARM-state register set
In ARM state, 16 general registers and one or two status registers are accessible at any
one time. In privileged modes, mode-specific banked registers become available. Figure
2-3 on page 2-10 shows which registers are available in each mode.

The ARM-state register set contains 16 directly-accessible registers, r0 to r15. A further
register, the CPSR, contains condition code flags and the current mode bits. Registers
r0 to r13 are general-purpose registers used to hold either data or address values.
Registers r14 and r15 have the following special functions:

Link register  Register r14 is used as the subroutine Link Register (LR).
Register r14 receives a copy of r15 when a Branch with Link (BL)
instruction is executed.
At all other times you can treat r14 as a general-purpose register.
The corresponding banked registers r14_svc, r14_irq, r14_fiq,
r14_abt and r14_und are similarly used to hold the return values
of r15 when interrupts and exceptions arise, or when BL
instructions are executed within interrupt or exception routines.

Program counter  Register r15 holds the PC.
In ARM state, bits [1:0] of r15 are undefined and must be ignored.
Bits [31:2] contain the PC.
In Thumb state, bit [0] is undefined and must be ignored. Bits
[31:1] contain the PC.

By convention, r13 is used as the Stack Pointer (SP).
In privileged modes, another register, the Saved Program Status Register (SPSR), is
accessible. This contains the condition code flags and the mode bits saved as a result of
the exception which caused entry to the current mode.
Banked registers are discrete physical registers in the core that are mapped to the
available registers depending on the current processor operating mode. Banked register
contents are preserved across operating mode changes.

FIQ mode has seven banked registers mapped to r8–r14 (r8_fiq–r14_fiq).
In ARM state, many FIQ handlers do not have to save any registers.
The User, IRQ, Supervisor, Abort, and undefined modes each have two banked registers
mapped to r13 and r14, allowing a private SP and LR for each mode.
System mode shares the same registers as User mode.

ARM-state general registers and program counter
System and User FIQ Supervisor Abort IRQ Undefined
r0 r0 r0 r0 r0 r0
r1 r1 r1 r1 r1 r1
r2 r2 r2 r2 r2 r2
r3 r3 r3 r3 r3 r3
r4 r4 r4 r4 r4 r4
r5 r5 r5 r5 r5 r5
r6 r6 r6 r6 r6 r6
r7 r7 r7 r7 r7 r7
r8 r8_fiq r8 r8 r8 r8
r9 r9_fiq r9 r9 r9 r9
r10 r10_fiq r10 r10 r10 r10
r11 r11_fiq r11 r11 r11 r11
r12 r12_fiq r12 r12 r12 r12
r13 r13_fiq r13_svc r13_abt r13_irq r13_und
r14 r14_fiq r14_svc r14_abt r14_irq r14_und
r15 (PC) r15 (PC) r15 (PC) r15 (PC) r15 (PC) r15 (PC)

2.6.2 The Thumb-state register set
The Thumb-state register set is a subset of the ARM-state set. The programmer has
access to:
* 8 general registers, r0–r7
*the PC
*the SP
*the LR
* the CPSR.

2.6.3 The relationship between ARM-state and Thumb-state registers
The Thumb-state registers relate to the ARM-state registers in the following way:
* Thumb-state r0–r7 and ARM-state r0–r7 are identical
* Thumb-state CPSR and SPSRs and ARM-state CPSR and SPSRs are identical
* Thumb-state SP maps onto the ARM-state r13
* Thumb-state LR maps onto the ARM-state r14
* Thumb-state pc maps onto the ARM-state pc (r15).

2.6.4 Accessing high registers in Thumb state
In Thumb state, the high registers, r8–r15, are not part of the standard register set. The
assembly language programmer has limited access to them, but can use them for fast
temporary storage.
You can use special variants of the MOV instruction to transfer a value from a low
register, in the range r0–r7, to a high register, and from a high register to a low register.
The CMP instruction enables you to compare high register values with low register
values. The ADD instruction enables you to add high register values to low register
values. For more details, see the ARM Architecture Reference Manual.

2.7 The program status registers
The ARM7TDMI processor contains a CPSR and five SPSRs for exception handlers to
use. The program status registers:
* hold information about the most recently performed ALU operation
* control the enabling and disabling of interrupts
* set the processor operating mode.

The arrangement of bits is shown in Figure 2-6.
Condition
code flags Reserved Control bits
31 30 29 28 27 26 25 24 23 8 7 6 5 4 3 2 1 0
N Z C V · · · · · · I F T M4M3M2 M1M0
Overflow Mode bits
Carryor borrow or extend State bit
Zero FIQ disable
Negative or less than IRQ disable
Figure 2-6 Program status register format

 To maintain compatibility with future ARM processors, you must not alter any of the
reserved bits. One method of preserving these bits is to use a read-write-modify strategy
when changing the CPSR.

2.7.1 Condition code flags
The N, Z, C, and V bits are the condition code flags, you can set them by arithmetic and
logical operations. They can also be set by MSR and LDM instructions. The
ARM7TDMI processor tests these flags to determine whether to execute an instruction.

All instructions can execute conditionally in ARM state. In Thumb state, only the
Branch instruction can be executed conditionally. For more information about
conditional execution, see the ARM Architecture Reference Manual.

2.7.2 Control bits
The bottom eight bits of a PSR are known collectively as the control bits. They are the:
* interrupt disable bits
* T bit
* mode bits.
The control bits change when an exception occurs. When the processor is operating in
a privileged mode, software can manipulate these bits.

Interrupt disable bits
The I and F bits are the interrupt disable bits:
* when the I bit is set, IRQ interrupts are disabled
* when the F bit is set, FIQ interrupts are disabled.

T bit
The T bit reflects the operating state:
* when the T bit is set, the processor is executing in Thumb state
* when the T bit is clear, the processor executing in ARM state.
The operating state is reflected on the external signal TBIT.
Caution
 Never use an MSR instruction to force a change to the state of the T bit in the CPSR. If
you do this, the processor enters an unpredictable state.

Mode bits
Bits M[4:0] determine the processor operating mode as shown in Table2-2. Not all
combinations of the mode bits define a valid processor mode, so take care to use only
the bit combinations shown.

M[4:0] Mode Visible Thumb-state registers Visible ARM-state registers
10000 User r0–r7, SP, LR, PC, CPSR r0–r14, PC, CPSR
10001 FIQ r0–r7, SP_fiq, LR_fiq, PC, CPSR,  r0–r7, r8_fiq–r14_fiq, PC, CPSR,
SPSR_fiq SPSR_fiq
10010 IRQ r0–r7, SP_irq, LR_irq, PC, CPSR,  r0–r12, r13_irq, r14_irq, PC, CPSR,
SPSR_irq SPSR_irq
10011 Supervisor r0–r7, SP_svc, LR_svc, PC, CPSR,  r0–r12, r13_svc, r14_svc, PC, CPSR,
SPSR_svc SPSR_svc
10111 Abort r0–r7, SP_abt, LR_abt, PC, CPSR,  r0–r12, r13_abt, r14_abt, PC, CPSR,
SPSR_abt SPSR_abt
11011 Undefined r0–r7, SP_und, LR_und, PC, CPSR,  r0–r12, r13_und, r14_und, PC, CPSR,
SPSR_und SPSR_und
11111 System r0–r7, SP, LR, PC, CPSR r0–r14, PC, CPSR

An illegal value programmed into M[4:0] causes the processor to enter an
unrecoverable state. If this occurs, apply reset.

2.7.3 Reserved bits
The remaining bits in the PSRs are unused, but are reserved. When changing a PSR flag
or control bits, make sure that these reserved bits are not altered. Also, make sure that
your program does not rely on reserved bits containing specific values because future
processors might have these bits set to 1 or 0.

2.8 Exceptions
Exceptions arise whenever the normal flow of a program has to be halted temporarily,
for example, to service an interrupt from a peripheral. Before attempting to handle an
exception, the ARM7TDMI processor preserves the current processor state so that the
original program can resume when the handler routine has finished.
If two or more exceptions arise simultaneously, the exceptions are dealt with in the fixed
order given in Table 2-3.

2.8.1 Exception entry and exit summary
Table2-3 summarizes the pc value preserved in the relevant r14 on exception entry, and
the recommended instruction for exiting the exception handler.
Table 2-3 Exception entry and exit
Exception  Previous state ARM r14_x
Return instruction Remarks
or entry  Thumb r14_x
BL MOV PC, R14 PC+4 PC+2 Where PC is the address of the BL, SWI, or
undefined instruction fetch that had the
SWI MOVS PC, R14_svc PC+4 PC+2
Prefetch Abort
UDEF MOVS PC, R14_und PC+4 PC+2
PABT SUBS PC, R14_abt, #4 PC+4 PC+4

Exception  Previous state ARM r14_x
Return instruction Remarks
or entry  Thumb r14_x
FIQ SUBS PC, R14_fiq, #4 PC+4 PC+4 Where PC is the address of the instruction
that was not executed because the FIQ or
IRQ SUBS PC, R14_irq, #4 PC+4 PC+4
IRQ took priority
DABT SUBS PC, R14_abt, #8 PC+8 PC+8 Where PC is the address of the Load or Store
instruction that generated the Data Abort
RESET Not applicable - - The value saved in r14_svc upon reset is
unpredictable

2.8.2 Entering an exception
The ARM7TDMI processor handles an exception as follows:
1. Preserves the address of the next instruction in the appropriate LR.
When the exception entry is from ARM state, the ARM7TDMI processor copies
the address of the next instruction into the LR, current PC+4 or PC+8 depending
on the exception.
When the exception entry is from Thumb state, the ARM7TDMI processor writes
the value of the PC into the LR, offset by a value, current PC+4 or PC+8
depending on the exception, that causes the program to resume from the correct
place on return.
The exception handler does not have to determine the state when entering an
exception. For example, in the case of a SWI, MOVS PC, r14_svc always returns to
the next instruction regardless of whether the SWI was executed in ARM or
Thumb state.
2. Copies the CPSR into the appropriate SPSR.
3. Forces the CPSR mode bits to a value that depends on the exception.
4. Forces the PC to fetch the next instruction from the relevant exception vector.
The ARM7TDMI processor can also set the interrupt disable flags to prevent otherwise
unmanageable nestings of exceptions.

Note
 Exceptions are always entered in ARM state. When the processor is in Thumb state and
an exception occurs, the switch to ARM state takes place automatically when the
exception vector address is loaded into the PC. An exception handler might change to
Thumb state but it must return to ARM state to enable the exception handler to
terminate correctly.

2.8.3 Leaving an exception
When an exception is completed, the exception handler must:
1. Move the LR, minus an offset to the PC. The offset varies according to the type
of exception, as shown in Table2-3 on page2-16.
2. Copy the SPSR back to the CPSR.
3. Clear the interrupt disable flags that were set on entry.
Note
 The action of restoring the CPSR from the SPSR automatically resets the T bit to
whatever value it held immediately prior to the exception.
2.8.4 Fast interrupt request
The Fast Interrupt Request (FIQ) exception supports data transfers or channel
processes. In ARM state, FIQ mode has eight banked registers to remove the
requirement for register saving. This minimizes the overhead of context switching.
An FIQ is externally generated by taking the nFIQ input LOW. The input passes into
the core through a synchronizer.
Irrespective of whether exception entry is from ARM state or from Thumb state, an FIQ
handler returns from the interrupt by executing:

SUBS PC,R14_fiq,#4
FIQ exceptions can be disabled within a privileged mode by setting the CPSR F flag.
When the F flag is clear, the ARM7TDMI processor checks for a LOW level on the
output of the FIQ synchronizer at the end of each instruction.

2.8.5 Interrupt request
The Interrupt Request (IRQ) exception is a normal interrupt caused by a LOW level on
the nIRQ input. IRQ has a lower priority than FIQ, and is masked on entry to an FIQ
sequence. As with the nFIQ input, nIRQ passes into the core through a synchronizer.
Irrespective of whether exception entry is from ARM state or Thumb state, an IRQ
handler returns from the interrupt by executing:
SUBS PC,R14_irq,#4
You can disable IRQ at any time, by setting the I bit in the CPSR from a privileged
mode.
2.8.6 Abort
An abort indicates that the current memory access cannot be completed. An abort is
signaled by the external ABORT input. The ARM7TDMI processor checks for the abort
exception at the end of memory access cycles.
The abort mechanism enables the implementation of a demand-paged virtual memory
system. In such a system, the processor is allowed to generate arbitrary addresses. When
the data at an address is unavailable, the Memory Management Unit (MMU) signals an
abort.
The abort handler must then:
* Work out the cause of the abort and make the requested data available.
* Load the instruction that caused the abort using an LDR Rn,[R14_abt,#-8]
instruction to determine whether that instruction specifies base register
write-back. If it does, the abort handler must then:
— determine from the instruction what the offset applied to the base register
by the write-back was
— apply the opposite offset to the value that will be reloaded into the base
register when the abort handler returns.
This ensures that when the instruction is retried, the base register will have been
restored to the value it had when the instruction was originally executed.
The application program needs no knowledge of the amount of memory available to it,
nor is its state in any way affected by the abort.
There are two types of abort:
* a Prefetch Abort occurs during an instruction prefetch
* a Data Abort occurs during a data access.

Prefetch Abort
When a Prefetch Abort occurs, the ARM7TDMI processor marks the prefetched
instruction as invalid, but does not take the exception until the instruction reaches the
Execute stage of the pipeline. If the instruction is not executed, for example because it
fails its condition codes or because a branch occurs while it is in the pipeline, the abort
does not take place.
After dealing with the reason for the abort, the handler executes the following
instruction irrespective of the processor operating state:
SUBS PC,R14_abt,#4
This action restores both the PC and the CPSR, and retries the aborted instruction.
Data Abort
When a Data Abort occurs, the action taken depends on the instruction type:
* Single data transfer instructions (LDR and STR). If write back base register is
specified by the instruction then the abort handler must be aware of this. In the
case of a load instruction the ARM7TDMI processor prevents overwriting of the
destination register with the loaded data.
* Swap instruction (SWP):
— on a read access suppresses the write access and the write to the destination
register
— on a write access suppresses the write to the destination register.
* Block data transfer instructions (LDM and STM) complete. When write-back is
specified, the base register is updated.
If the base register is in the transfer list and has already been overwritten with
loaded data by the time that the abort is indicated then the base register reverts to
the original value. The ARM7TDMI processor prevents all register overwriting
with loaded data after an abort is indicated. This means that the final value of the
base register is always the written-back value, if write-back is specified, at its
original value. It also means that the ARM7TDMI core always preserves r15 in
an aborted LDM instruction, because r15 is always either the last register in the
transfer list or not present in the transfer list.
After fixing the reason for the abort, the handler must execute the following return
instruction irrespective of the processor operating state at the point of entry:
SUBS PC,R14_abt,#8
This action restores both the PC and the CPSR, and retries the aborted instruction.

2.8.7 Software interrupt instruction
The Software Interrupt instruction (SWI) is used to enter Supervisor mode, usually to
request a particular supervisor function. The SWI handler reads the opcode to extract
the SWI function number.
A SWI handler returns by executing the following irrespective of the processor
operating state:
MOVS PC, R14_svc
This action restores the PC and CPSR, and returns to the instruction following the SWI.
2.8.8 Undefined instruction
When the ARM7TDMI processor encounters an instruction that neither it, nor any
coprocessor in the system can handle, the ARM7TDMI core takes the undefined
instruction trap. Software can use this mechanism to extend the ARM instruction set by
emulating undefined coprocessor instructions.
After emulating the failed instruction, the trap handler executes the following
irrespective of the processor operating state:
MOVS PC,R14_und
This action restores the CPSR and returns to the next instruction after the undefined
instruction.
For more information about undefined instructions, see the ARM Architecture Reference
Manual.
2.8.9 Exception vectors
Table 2-4 lists the exception vector addresses. In this table, I and F represent the
previous value of the IRQ and FIQ interrupt disable bits respectively in the CPSR.
Table 2-4 Exception vectors
Address  Exception Mode on entry I state on entry F state on entry
0x00000000 Reset Supervisor Set Set
0x00000004 Undefined instruction Undefined Set Unchanged
0x00000008 Software interrupt Supervisor  Set Unchanged
0x0000000C Prefetch Abort Abort Set Unchanged

Address  Exception Mode on entry I state on entry F state on entry
0x00000010 Data Abort Abort Set Unchanged
0x00000014 Reserved Reserved - -
0x00000018 IRQ IRQ Set Unchanged
0x0000001C FIQ FIQ Set Set
2.8.10 Exception priorities
When multiple exceptions arise at the same time, a fixed priority system determines the
order in which they are handled. The priority order is listed in Table 2-5.
Table 2-5 Exception priority order
Priority Exception
Highest Reset
Data Abort
FIQ
IRQ
Prefetch Abort
Lowest Undefined instruction and SWI
Some exceptions cannot occur together:
* The undefined instruction and SWI exceptions are mutually exclusive. Each
corresponds to a particular, non-overlapping, decoding of the current instruction.
* When FIQs are enabled, and a Data Abort occurs at the same time as an FIQ, the
ARM7TDMI processor enters the Data Abort handler, and proceeds immediately
to the FIQ vector.
A normal return from the FIQ causes the Data Abort handler to resume execution.
Data Aborts must have higher priority than FIQs to ensure that the transfer error
does not escape detection. You must add the time for this exception entry to the
worst-case FIQ latency calculations in a system that uses aborts to support virtual
memory.

2.9 Interrupt latencies
The calculations for maximum and minimum latency are described in:
* Maximum interrupt latencies
* Minimum interrupt latencies.
2.9.1 Maximum interrupt latencies
When FIQs are enabled, the worst-case latency for FIQ comprises a combination of:
Tsyncmax  The longest time the request can take to pass through the synchronizer.
Tsyncmax is four processor cycles.
Tldm  The time for the longest instruction to complete. The longest instruction
is an LDM that loads all the registers including the PC. Tldm is 20 cycles
in a zero wait state system.
Texc  The time for the Data Abort entry. Texc is three cycles.
Tfiq  The time for FIQ entry. Tfiq is two cycles.
The total latency is therefore 29 processor cycles, just over 0.7 microseconds in a
system that uses a continuous 40MHz processor clock. At the end of this time, the
ARM7TDMI processor executes the instruction at 0x1c.
The maximum IRQ latency calculation is similar, but must allow for the fact that FIQ,
having higher priority, can delay entry into the IRQ handling routine for an arbitrary
length of time.
2.9.2 Minimum interrupt latencies
The minimum latency for FIQ or IRQ is the shortest time the request can take through
the synchronizer, Tsyncmin, plus Tfiq, a total of five processor cycles.

2.10 Reset
When the nRESET signal goes LOW a reset occurs, and the ARM7TDMI core
abandons the executing instruction and continues to increment the address bus as if still
fetching word or halfword instructions. nMREQ and SEQ indicates internal cycles
during this time.
When nRESET goes HIGH again, the ARM7TDMI processor:
1. Overwrites R14_svc and SPSR_svc by copying the current values of the PC and
CPSR into them. The values of the PC and CPSR are indeterminate.
2. Forces M[4:0] to b10011, Supervisor mode, sets the I and F bits, and clears the
T-bit in the CPSR.
3. Forces the PC to fetch the next instruction from address 0x00.
4. Reverts to ARM state if necessary and resumes execution.
After reset, all register values except the PC and CPSR are indeterminate.
More information is provided in Reset sequence after power up on page3-32.