SAMSUNG's S3C44B0X 16/32-bit RISC microprocessor is designed to provide a cost-effective and high performance
micro-controller solution for hand-held devices and general applications. To reduce total system cost, S3C44B0X
also provides the following: 8KB cache, optional internal SRAM, LCD controller, 2-channel UART with handshake, 4channel DMA, System manager (chip select logic, FP/ EDO/SDRAM controller), 5-channel timers with PWM, I/O
ports, RTC, 8-channel 10-bit ADC, IIC-BUS interface, IIS-BUS interface, Sync. SIO interface and PLL for clock.
The S3C44B0X was developed using a ARM7TDMI core, 0.25 um CMOS standard cells, and a memory compiler. Its
low-power, simple, elegant and fully static design is particularly suitable for cost-sensitive and power sensitive
applications. Also S3C44B0X adopts a new bus architecture, SAMBA II (SAMSUNG ARM CPU embedded
Microcontroller Bus Architecture).
An outstanding feature of the S3C44B0X is its CPU core, a 16/32-bit ARM7TDMI RISC processor (66MHz) designed
by Advanced RISC Machines, Ltd. The architectural enhancements of ARM7TDMI include the Thumb decompressor, an on-chip ICE breaker debug support, and a 32-bit hardware multiplier.
By providing a complete set of common system peripherals, the S3C44B0X minimizes overall system costs and
eliminates the need to configure additional components. The integrated on-chip functions that are described in this
document are as follows:
•2.5V Static ARM7TDMI CPU core with 8KB cache . (SAMBA II bus architecture up to 66MHz)
•LCD controller (up to 256 color DSTN) with 1-ch LCD-dedicated DMA.
•2-ch general DMAs / 2-ch peripheral DMAs with external request pins
•2-ch UART with handshake(IrDA1.0, 16-byte FIFO) / 1-ch SIO
•1-ch multi-master IIC-BUS controller
•1-ch IIS-BUS controller
•5-ch PWM timers & 1-ch internal timer
•Watch Dog Timer
•71 general purpose I/O ports / 8-ch external interrupt source
•Power control: Normal, Slow, Idle, and Stop mode
•8-ch 10-bit ADC.
•RTC with calendar function.
•On-chip clock generator with PLL.
1-1
PRODUCT OVERVIEWS3C44B0X RISC MICROPROCESSOR
FEATURES
Architecture
•Integrated system for hand-held devices and
general embedded applications.
•16/32-Bit RISC architecture and powerful
instruction set with ARM7TDMI CPU core.
•Thumb de-compressor maximizes code density
while maintaining performance.
•On-chip ICEbreaker debug support with JTAG-
based debugging solution.
•32x8 bit hardware multiplier.
•New bus architecture to implement Low-Power
SAMBA II(SAMSUNG's ARM CPU embedded
Micro-controller Bus Architecture).
System Manager
•Little/Big endian support.
•Address space: 32Mbytes per each bank. (Total
256Mbyte)
•Supports programmable 8/16/32-bit data bus
width for each bank.
•Fixed bank start address and programmable bank
size for 7 banks.
•Programmable bank start address and bank size
for one bank.
•8 memory banks.
- 6 memory banks for ROM, SRAM etc.
- 2 memory banks for ROM/SRAM/DRAM(Fast
Page, EDO, and Synchronous DRAM)
•Fully Programmable access cycles for all
memory banks.
•Supports external wait signal to expend the bus
cycle.
•Supports self-refresh mode in DRAM/SDRAM for
power-down.
•Supports asymmetric/symmetric address of
DRAM.
Cache Memory & internal SRAM
•4-way set associative ID(Unified)-cache with
8Kbyte.
•The 0/4/8 Kbytes internal SRAM using unused
cache memory.
•Pseudo LRU(Least Recently Used) Replace
Algorithm.
•Write through policy to maintain the coherence
between main memory and cache content.
•Write buffer with four depth.
•Request data first fill technique when cache miss
occurs.
Clock & Power Manager
•Low power
•The on-chip PLL makes the clock for operating
MCU at maximum 66MHz.
•Clock can be fed selectively to each function
block by software.
•Power mode: Normal, Slow, Idle and Stop mode.
Normal mode: Normal operating mode.
Slow mode: Low frequency clock without PLL
Idle mode: Stop the clock for only CPU
Stop mode: All clocks are stopped
1. OM[3:0] and ENDIAN value are latched only at the rising edge of nRESET. Therefore, when nRESET is L, the pins of
OM[3:0] and ENDIAN are in input state. After nRESET becomes H, the pin of ENDIAN will be in output state.
2. The @BUS REQ. shows the pin states at the external bus, which is used by the other bus master. The @STOP shows
the pin states when S3C44B0X is in STOP mode.
3. ' − ' mark indicates the unchanged pin state at STOP mode or Bus released mode.
4. IICSDA,IICSCL pins are open-drain type.
5. AI/AO means analog input/output.
1-16
S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW
I/O TypeDescriptions
vdd2i, vss2i2.5V Vdd/Vss for internal logic
vdd3op, vss3op3.3V Vdd/Vss for external interface logic
vdd2t, vss2t2.5V Vdd/Vss for analog circuitry
phsoscm16Oscillator cell with enable and feedback resistor
phbsu50ct12smbi-directional pad, CMOS schmitt-trigger, 50K Ω pull-up resistor with control,
tri-state, Io=12mA
phbsu50ct8smbi-directional pad, CMOS schmitt-trigger, 50K Ω pull-up resistor with control,
tri-state, Io=8mA
phbsu50cd4smbi-directional pad, CMOS schmitt-trigger, 50K Ω pull-up resistor with control,
OM[1:0]IOM[1:0] sets S3C44B0X in the TEST mode, which is used only at fabrication. Also, it
determines the bus width of nGCS0. The logic level is determined by the pull-up/down
resistor during the RESET cycle.
00:8-bit01:16-bit10:32-bit11:Test mode
ADDR[24:0]OADDR[24:0] (Address Bus) outputs the memory address of the corresponding bank .
DATA[31:0]IODATA[31:0] (Data Bus) inputs data during memory read and outputs data during
memory write. The bus width is programmable among 8/16/32-bit.
nGCS[7:0]OnGCS[7:0] (General Chip Select) are activated when the address of a memory is within
the address region of each bank. The number of access cycles and the bank size can
be programmed.
nWEOnWE (Write Enable) indicates that the current bus cycle is a write cycle.
nWBE[3:0]OWrite Byte Enable
nBE[3:0]OUpper Byte/Lower Byte Enable(In case of SRAM)
nOEOnOE (Output Enable) indicates that the current bus cycle is a read cycle.
nXBREQInXBREQ (Bus Hold Request) allows another bus master to request control of the local
bus. BACK active indicates that bus control has been granted.
nXBACKOnXBACK (Bus Hold Acknowledge) indicates that the S3C44B0X has surrendered
control of the local bus to another bus master.
nWAITInWAIT requests to prolong a current bus cycle. As long as nWAIT is L, the current bus
cycle cannot be completed.
ENDIANIIt determines whether or not the data type is little endian or big endian. The logic level
is determined by the pull-up/down resistor during the RESET cycle.
RxD[1:0]IUART receives data input
TxD[1:0]OUART transmits data output
nCTS[1:0]IUART clear to send input signal
nRTS[1:0]OUART request to send output signal
IIC-BUS
IICSDAIOIIC-bus data
IICSCLIOIIC-bus clock
IIS-BUS
IISLRCKIOIIS-bus channel select clock
IISDOOIIS-bus serial data output
IISDIIIIS-bus serial data input
IISCLKIOIIS-bus serial clock
CODECLKOCODEC system clock
SIO
SIORXDISIO receives data input
SIOTXDOSIO transmits data output
SIOCKIOSIO clock
SIORDYIOSIO handshake signal when DMA completes the SIO operation
1-19
PRODUCT OVERVIEWS3C44B0X RISC MICROPROCESSOR
Table 1-3. S3C44B0X Signal Descriptions (Continued)
SignalI/ODescription
ADC
AIN[7:0]AIADC input[7:0]
AREFTAIADC Top Vref
AREFBAIADC Bottom Vref
AVCOMAIADC Common Vref
GENERAL PORT
P[70:0]IOGeneral input/output ports (some ports are output mode only)
RESET & CLOCK
nRESETSTnRESET suspends any operation in progress and places S3C44B0X into a known reset
state. For a reset, nRESET must be held to L level for at least 4 MCLK after the
processor power has been stabilized.
OM[3:2]IOM[3:2] determines how the clock is made.
00 = Crystal(XTAL0,EXTAL0), PLL on 01 = EXTCLK, PLL on
10, 11 = Chip test mode.
EXTCLKIExternal clock source when OM[3:2] = 01b
If it isn't used, it has to be H (3.3V).
XTAL0AICrystal Input for internal osc circuit for system clock.
If it isn't used, XTAL0 has to be H (3.3V).
EXTAL0AOCrystal Output for internal osc circuit for system clock. It is the inverted output of
XTAL0. If it isn't used, it has to be a floating pin.
PLLCAPAILoop filter capacitor for system clock PLL. ( 700pF )
XTAL1AI32 KHz crystal input for RTC.
EXTAL1AO32 KHz crystal output for RTC. It is the inverted output of XTAL1.
CLKoutOFout or Fpllo clock
JTAG TEST LOGIC
nTRSTInTRST(TAP Controller Reset) resets the TAP controller at start.
If debugger is used, A 10K pull-up resistor has to be connected.
If debugger(black ICE) is not used, nTRST pin must be at L or low active pulse.
TMSITMS (TAP Controller Mode Select) controls the sequence of the TAP controller's
states. A 10K pull-up resistor has to be connected to TMS pin.
TCKITCK (TAP Controller Clock) provides the clock input for the JTAG logic.
A 10K pull-up resistor must be connected to TCK pin.
TDIITDI (TAP Controller Data Input) is the serial input for test instructions and data.
A 10K pull-up resistor must be connected to TDI pin.
TDOOTDO (TAP Controller Data Output) is the serial output for test instructions and data.
1-20
S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW
Table 1-3. S3C44B0X Signal Descriptions (Concluded)
SignalI/ODescription
POWER
VDDPS3C44B0X core logic VDD (2.5 V)
VSSPS3C44B0X core logic VSS
VDDIOPS3C44B0X I/O port VDD (3.3 V)
VSSIOPS3C44B0X I/O port VSS
RTCVDDPRTC VDD (2.5 V or 3.0 V, Not support 3.3V)
(This pin must be connected to power properly if RTC isn't used)
VDDADCPADC VDD(2.5 V)
VSSADCPADC VSS
1-21
PRODUCT OVERVIEWS3C44B0X RISC MICROPROCESSOR
S3C44B0X SPECIAL REGISTERS
Table 1-4. S3C44B0X Special Registers
Register
Name
Address
(B. Endian)
Address
(L. Endian)
Acc.
Unit
Read/
Write
Function
CPU WRAPPER
SYSCFG0x01c00000←WR/WSystem Configuration
NCACHBE00x01c00004Non Cacheable Area 0
NCACHBE10x01c00008Non Cacheable Area 1
SBUSCON0x01c40000System Bus Control
MEMORY CONTROLLER
BWSCON0x01c80000←WR/WBus Width & Wait Status Control
BANKCON00x01c80004Boot ROM Control
BANKCON10x01c80008BANK1 Control
BANKCON20x01c8000cBANK2 Control
BANKCON30x01c80010BANK3 Control
BANKCON40x01c80014BANK4 Control
BANKCON50x01c80018BANK5 Control
BANKCON60x01c8001cBANK6 Control
BANKCON70x01c80020BANK7 Control
REFRESH0x01c80024DRAM/SDRAM Refresh Control
BANKSIZE0x01c80028Flexible Bank Size
MRSRB60x01c8002cMode register set for SDRAM
MRSRB70x01c80030Mode register set for SDRAM
1-22
S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW
Table 1-4. S3C44B0X Special Registers (Continued)
Register
Name
Address
(B. Endian)
Address
(L. Endian)
Acc.
Unit
Read/
Write
Function
UART
ULCON00x01d00000←WR/WUART 0 Line Control
ULCON10x01d04000UART 1 Line Control
UCON00x01d00004UART 0 Control
UCON10x01d04004UART 1 Control
UFCON00x01d00008UART 0 FIFO Control
UFCON10x01d04008UART 1 FIFO Control
UMCON00x01d0000cUART 0 Modem Control
UMCON10x01d0400cUART 1 Modem Control
UTRSTAT00x01d00010RUART 0 Tx/Rx Status
UTRSTAT10x01d04010UART 1 Tx/Rx Status
UERSTAT00x01d00014UART 0 Rx Error Status
UERSTAT10x01d04014UART 1 Rx Error Status
UFSTAT00x01d00018UART 0 FIFO Status
UFSTAT10x01d04018UART 1 FIFO Status
UMSTAT00x01d0001cUART 0 Modem Status
UMSTAT10x01d0401cUART 1 Modem Status
UTXH00x01d000230x01d00020BWUART 0 Transmission Hold
UTXH10x01d040230x01d04020UART 1 Transmission Hold
URXH00x01d000270x01d00024RUART 0 Receive Buffer
URXH10x01d040270x01d04024UART 1 Receive Buffer
UBRDIV00x01d00028←WR/WUART 0 Baud Rate Divisor
UBRDIV10x01d04028UART 1 Baud Rate Divisor
SIO
SIOCON0x01d14000←WR/WSIO Control
SIODAT0x01d14004SIO Data
SBRDR0x01d14008SIO Baud Rate Prescaler
ITVCNT0x01d1400cSIO Interval Counter
DCNTZ0x01d14010SIO DMA Count Zero
1-23
PRODUCT OVERVIEWS3C44B0X RISC MICROPROCESSOR
Table 1-4. S3C44B0X Special Registers (Continued)
Register
Name
Address
(B. Endian)
Address
(L. Endian)
Acc.
Unit
Read/
Write
Function
IIS
IISCON0x01d18000,02,030x01d18000B,HW,WR/WIIS Control
IISMOD0x01d18004,060x01d18004HW,WIIS Mode
IISPSR0x01d18008,0a,0b0x01d18008B,HW,WIIS Prescaler
IISFIFCON0x01d1800c,0e0x01d1800cHW,WIIS FIFO Control
IISFIF0x01d180120x01d18010HWIIS FIFO Entry
I/O PORT
PCONA0x01d20000←WR/WPort A Control
PDATA0x01d20004Port A Data
PCONB0x01d20008Port B Control
PDATB0x01d2000cPort B Data
PCONC0x01d20010Port C Control
PDATC0x01d20014Port C Data
PUPC0x01d20018Pull-up Control C
PCOND0x01d2001cPort D Control
PDATD0x01d20020Port D Data
PUPD0x01d20024Pull-up Control D
PCONE0x01d20028Port E Control
PDATE0x01d2002cPort E Data
PUPE0x01d20030Pull-up Control E
PCONF0x01d20034Port F Control
PDATF0x01d20038Port F Data
PUPF0x01d2003cPull-up Control F
PCONG0x01d20040Port G Control
PDATG0x01d20044Port G Data
PUPG0x01d20048Pull-up Control G
SPUCR0x01d2004cSpecial Pull-up
EXTINT0x01d20050External Interrupt Control
EXTINPND0x01d20054External Interrupt Pending
WATCHDOG TIMER
WTCON0x01d30000←WR/WWatchdog Timer Mode
WTDAT0x01d30004Watchdog Timer Data
WTCNT0x01d30008Watchdog Timer Count
1-24
S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW
Table 1-4. S3C44B0X Special Registers (Continued)
Register
Name
Address
(B. Endian)
Address
(L. Endian)
Acc.
Unit
Read/
Write
Function
A/D CONVERTER
ADCCON0x01d40000,02,030x01d40000B,HW,WR/WADC Control
ADCPSR0x01d40004,06,070x01d40004ADC Prescaler
ADCDAT0x01d40008,0a0x01d40008HW,WRDigitized 10 bit Data
IICCON0x01d60000←WR/WIIC Control
IICSTAT0x01d60004IIC Status
IICADD0x01d60008IIC Address
IICDS0x01d6000cIIC Data Shift
1-25
PRODUCT OVERVIEWS3C44B0X RISC MICROPROCESSOR
Table 1-4. S3C44B0X Special Registers (Continued)
Register
Name
Address
(B. Endian)
Address
(L. Endian)
Acc.
Unit
Read/
Write
RTC
RTCCON0x01d700430x01d70040BR/WRTC Control
RTCALM0x01d700530x01d70050RTC Alarm
ALMSEC0x01d700570x01d70054Alarm Second
ALMMIN0x01d7005b0x01d70058Alarm Minute
ALMHOUR0x01d7005f0x01d7005cAlarm Hour
ALMDAY0x01d700630x01d70060Alarm Day
ALMMON0x01d700670x01d70064Alarm Month
ALMYEAR0x01d7006b0x01d70068Alarm Year
RTCRST0x01d7006f0x01d7006cRTC Round Reset
BCDSEC0x01d700730x01d70070BCD Second
BCDMIN0x01d700770x01d70074BCD Minute
BCDHOUR0x01d7007b0x01d70078BCD Hour
BCDDAY0x01d7007f0x01d7007cBCD Day
BCDDATE0x01d700830x01d70080BCD Date
BCDMON0x01d700870x01d70084BCD Month
Function
BCDYEAR0x01d7008b0x01d70088BCD Year
TICINT0x01D7008E0x01D7008CTick time count
CLOCK & POWER MANAGEMENT
PLLCON0x01d80000←WR/WPLL Control
CLKCON0x01d80004Clock Control
CLKSLOW0x01d80008Slow clock Control
LOCKTIME0x01d8000cPLL lock time Counter
1-26
S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW
Table 1-4. S3C44B0X Special Registers (Continued)
Register
Name
Address
(B. Endian)
Address
(L. Endian)
Acc.
Unit
Read/
Write
Function
INTERRUPT CONTROLLER
INTCON0x01e00000←WR/WInterrupt Control
INTPND0x01e00004RInterrupt Request Status
INTMOD0x01e00008R/WInterrupt Mode Control
INTMSK0x01e0000cInterrupt Mask Control
I_PSLV0x01e00010IRQ Interrupt Previous Slave
I_PMST0x01e00014IRQ Interrupt Priority Master
I_CSLV0x01e00018RIRQ Interrupt Current Slave
I_CMST0x01e0001cIRQ Interrupt Current Master
I_ISPR0x01e00020IRQ Interrupt Pending Status
I_ISPC0x01e00024WIRQ Interrupt Pending Clear
F_ISPR0x01e00038RFIQ Interrupt Pending
F_ISPC0x01e0003cWFIQ Interrupt Pending Clear
ZDCON00x01e80000←WR/WZDMA0 Control
ZDISRC00x01e80004ZDMA 0 Initial Source Address
ZDIDES00x01e80008ZDMA 0 Initial Destination Address
ZDICNT00x01e8000cZDMA 0 Initial Transfer Count
ZDCSRC00x01e80010RZDMA 0 Current Source Address
ZDCDES00x01e80014ZDMA 0 Current Destination Address
ZDCCNT00x01e80018ZDMA 0 Current Transfer Count
ZDCON10x01e80020R/WZDMA 1 Control
ZDISRC10x01e80024ZDMA 1 Initial Source Address
ZDIDES10x01e80028ZDMA 1 Initial Destination Address
ZDICNT10x01e8002cZDMA 1 Initial Transfer Count
ZDCSRC10x01e80030RZDMA 1 Current Source Address
ZDCDES10x01e80034ZDMA 1 Current Destination Address
ZDCCNT10x01e80038ZDMA 1 Current Transfer Count
BDCON00x01f80000R/WBDMA 0 Control
BDISRC00x01f80004BDMA 0 Initial Source Address
BDIDES00x01f80008BDMA 0 Initial Destination Address
BDICNT00x01f8000cBDMA 0 Initial Transfer Count
BDCSRC00x01f80010RBDMA 0 Current Source Address
BDCDES00x01f80014BDMA 0 Current Destination Address
BDCCNT00x01f80018BDMA 0 Current Transfer Count
BDCON10x01f80020R/WBDMA 1 Control
BDISRC10x01f80024BDMA 1 Initial Source Address
BDIDES10x01f80028BDMA 1 Initial Destination Address
BDICNT10x01f8002cBDMA 1 Initial Transfer Count
BDCSRC10x01f80030RBDMA 1 Current Source Address
BDCDES10x01f80034BDMA 1 Current Destination Address
BDCCNT10x01f80038BDMA 1 Current Transfer Count
1-28
S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW
IMPORTANT NOTES ABOUT S3C44B0X SPECIAL REGISTERS
1.In the little endian mode, L. endian address must be used. In the big endian mode, B. endian address must be
used.
2.The special registers have to be accessed by the recommended access unit.
3.All registers except ADC registers, RTC registers and UART registers must be read/written in word unit (32bit) at
little/big endian.
4. It is very important that the ADC registers, RTC registers and UART registers be read/written by the specified
access unit and the specified address. Moreover, one must carefully consider which endian mode is used.
5. W: 32-bit register, which must be accessed by LDR/STR or int type pointer(int *).
HW: 16-bit register, which must be accessed by LDRH/STRH or short int type pointer(short int *).
B: 8-bit register, which must be accessed by LDRB/STRB or char type pointer(char *).
1-29
S3C44B0X RISC MICROPROCESSORPROGRAMMER'S MODEL
2PROGRAMMER'S MODEL
OVERVIEW
S3C44B0X has been developed using the advanced ARM7TDMI core, which has been designed by Advanced
RISC Machines, Ltd.
PROCESSOR OPERATING STATES
From the programmer's point of view, the ARM7TDMI can be in one of two states:
•ARM state which executes 32-bit, word-aligned ARM instructions.
•THUMB state which can execute 16-bit, halfword-aligned THUMB instructions. In this state, the PC uses bit 1
to select between alternate halfwords.
NOTE
Transition between these two states does not affect the processor mode or the contents of the registers.
SWITCHING STATE
Entering THUMB State
Entry into THUMB state can be achieved by executing a BX instruction with the state bit (bit 0) set in the operand
register.
Transition to THUMB state will also occur automatically on return from an exception (IRQ, FIQ, UNDEF, ABORT,
SWI etc.), if the exception was entered with the processor in THUMB state.
Entering ARM State
Entry into ARM state happens:
•On execution of the BX instruction with the state bit clear in the operand register.
•On the processor taking an exception (IRQ, FIQ, RESET, UNDEF, ABORT, SWI etc.). In this case, the PC is
placed in the exception mode's link register, and execution commences at the exception's vector address.
MEMORY FORMATS
ARM7TDMI views memory as a linear collection of bytes numbered upwards from zero. Bytes 0 to 3 hold the first
stored word, bytes 4 to 7 the second and so on. ARM7TDMI can treat words in memory as being stored either in
Big-Endian or Little-Endian format.
2-1
PROGRAMMER'S MODELS3C44B0X RISC MICROPROCESSOR
BIG-ENDIAN FORMAT
In Big-Endian format, the most significant byte of a word is stored at the lowest numbered byte and the least
significant byte at the highest numbered byte. Byte 0 of the memory system is therefore connected to data lines
31 through 24.
Higher Address
Lower Address
31
8
4
0
Most significant byte is at lowest address.
Word is addressed by byte address of most significant byte.
23
241516
9
5
1
10
6
2
870
11
7
3
Word Address
8
4
0
Figure 2-1. Big-Endian Addresses of Bytes within Words
LITTLE-ENDIAN FORMAT
In Little-Endian format, the lowest numbered byte in a word is considered the word's least significant byte, and
the highest numbered byte the most significant. Byte 0 of the memory system is therefore connected to data lines
7 through 0.
Higher Address
3123870
241516
Word Address
8
4
0
Lower Address
11
7
3
Least significant byte is at lowest address.
Word is addressed by byte address of least significant byte.
10
6
2
9
5
1
8
4
0
Figure 2-2. Little-Endian Addresses of Bytes whthin Words
INSTRUCTION LENGTH
Instructions are either 32 bits long (in ARM state) or 16 bits long (in THUMB state).
Data Types
ARM7TDMI supports byte (8-bit), halfword (16-bit) and word (32-bit) data types. Words must be aligned to fourbyte boundaries and half words to two-byte boundaries.
2-2
S3C44B0X RISC MICROPROCESSORPROGRAMMER'S MODEL
OPERATING MODES
ARM7TDMI supports seven modes of operation:
•User (usr): The normal ARM program execution state
•FIQ (fiq): Designed to support a data transfer or channel process
•IRQ (irq): Used for general-purpose interrupt handling
•Supervisor (svc): Protected mode for the operating system
•Abort mode (abt): Entered after a data or instruction prefetch abort
•System (sys): A privileged user mode for the operating system
•Undefined (und): Entered when an undefined instruction is executed
Mode changes may be made under software control, or may be brought about by external interrupts or exception
processing. Most application programs will execute in User mode. The non-user modes' known as privileged
modes-are entered in order to service interrupts or exceptions, or to access protected resources.
REGISTERS
ARM7TDMI has a total of 37 registers - 31 general-purpose 32-bit registers and six status registers - but these
cannot all be seen at once. The processor state and operating mode dictate which registers are available to the
programmer.
The ARM State Register Set
In ARM state, 16 general registers and one or two status registers are visible at any one time. In privileged (nonUser) modes, mode-specific banked registers are switched in. Figure 2-3 shows which registers are available in
each mode: the banked registers are marked with a shaded triangle.
The ARM state register set contains 16 directly accessible registers: R0 to R15. All of these except R15 are
general-purpose, and may be used to hold either data or address values. In addition to these, there is a
seventeenth register used to store status information.
Register 14is used as the subroutine link register. This receives a copy of R15 when a Branch
and Link (BL) instruction is executed. At all other times it may be treated as a
general-purpose register. The corresponding banked registers R14_svc, R14_irq,
R14_fiq, R14_abt and R14_und are similarly used to hold the return values of R15
when interrupts and exceptions arise, or when Branch and Link instructions are
executed within interrupt or exception routines.
Register 15holds the Program Counter (PC). In ARM state, bits [1:0] of R15 are zero and bits
[31:2] contain the PC. In THUMB state, bit [0] is zero and bits [31:1] contain the PC.
Register 16is the CPSR (Current Program Status Register). This contains condition code flags
and the current mode bits.
FIQ mode has seven banked registers mapped to R8-14 (R8_fiq-R14_fiq). In ARM state, many FIQ handlers do
not need to save any registers. User, IRQ, Supervisor, Abort and Undefined each have two banked registers
mapped to R13 and R14, allowing each of these modes to have a private stack pointer and link registers.
The THUMB state register set is a subset of the ARM state set. The programmer has direct access to eight
general registers, R0-R7, as well as the Program Counter (PC), a stack pointer register (SP), a link register (LR),
and the CPSR. There are banked Stack Pointers, Link Registers and Saved Process Status Registers (SPSRs)
for each privileged mode. This is shown in Figure 2-4.
THUMB State General Registers and Program Counter
System & User
R0
R1
R2
R3
R4
R5
R6
R7
SP
LR
PC
CPSRCPSR
= banked register
FIQ
R0
R1
R2
R3
R4
R5
R6
R7
SP_fiq
LR_fiq
PC
SupervisorIRQAbortUndefined
R0
R1
R2
R3
R4
R5
R6
R7
SP_svc
LR_svc
PC
R0
R1
R2
R3
R4
R5
R6
R7
SP_abt
LR_abt
PC
THUMB State Program Status Registers
SPSR_fiq
CPSR
SPSR_svc
CPSR
SPSR_abt
R0
R1
R2
R3
R4
R5
R6
R7
SP_und
LR_und
PC
CPSR
SPSR_irq
R0
R1
R2
R3
R4
R5
R6
R7
SP_fiq
LR_fiq
PC
CPSR
SPSR_und
Figure 2-4. Register Organization in THUMB State
2-5
PROGRAMMER'S MODELS3C44B0X RISC MICROPROCESSOR
Lo-registersHi-registers
The relationship between ARM and THUMB state registers
The THUMB state registers relate to the ARM state registers in the following way:
•THUMB state R0-R7 and ARM state R0-R7 are identical
•THUMB state CPSR and SPSRs and ARM state CPSR and SPSRs are identical
•THUMB state SP maps onto ARM state R13
•THUMB state LR maps onto ARM state R14
•The THUMB state Program Counter maps onto the ARM state Program Counter (R15)
This relationship is shown in Figure 2-5.
THUMB stateARM state
R0
R1
R2
R3
R4
R5
R6
R7
Stack Pointer (SP)
Link register (LR)
Program Counter (PC)
CPSR
SPSR
R0
R1
R2
R3
R4
R5
R6
R7
R8
R9
R10
R11
R12
Stack Pointer (R13)
Link register (R14)
Program Counter (R15)
CPSR
SPSR
2-6
Figure 2-5. Mapping of THUMB State Registers onto ARM State Registers
S3C44B0X RISC MICROPROCESSORPROGRAMMER'S MODEL
Accessing Hi-Registers in THUMB State
In THUMB state, registers R8-R15 (the Hi registers) are not part of the standard register set. However, the
assembly language programmer has limited access to them, and can use them for fast temporary storage.
A value may be transferred from a register in the range R0-R7 (a Lo register) to a Hi register, and from a Hi
register to a Lo register, using special variants of the MOV instruction. Hi register values can also be compared
against or added to Lo register values with the CMP and ADD instructions. For more information, refer to Figure
3-34.
THE PROGRAM STATUS REGISTERS
The ARM7TDMI contains a Current Program Status Register (CPSR), plus five Saved Program Status Registers
(SPSRs) for use by exception handlers. These register's functions are:
•Hold information about the most recently performed ALU operation
•Control the enabling and disabling of interrupts
•Set the processor operating mode
The arrangement of bits is shown in Figure 2-6.
Condition Code Flags
31
3029272826252423876543210
NZCVIFTM4 M3M2 M1 M0
Overflow
Carry/Borrow/Extend
Zero
Negative/Less Than
(Reserved)Control Bits
~
~
~
~
Mode bits
State bit
FIQ disable
IRQ disable
Figure 2-6. Program Status Register Format
2-7
PROGRAMMER'S MODELS3C44B0X RISC MICROPROCESSOR
The Condition Code Flags
The N, Z, C and V bits are the condition code flags. These may be changed as a result of arithmetic and logical
operations, and may be tested to determine whether an instruction should be executed.
In ARM state, all instructions may be executed conditionally: see Table 3-2 for details.
In THUMB state, only the Branch instruction is capable of conditional execution: see Figure 3-46 for details.
The Control Bits
The bottom 8 bits of a PSR (incorporating I, F, T and M[4:0]) are known collectively as the control bits. These will
be changed when an exception arises. If the processor is operating in a privileged mode, they can also be
manipulated by software.
The T bit
This reflects the operating state. When this bit is set, the processor is executing in THUMB
state, otherwise it is executing in ARM state. This is reflected on the TBIT external signal.
Note that the software must never change the state of the TBIT in the CPSR. If this
happens, the processor will enter an unpredictable state.
Interrupt disable bits
The I and F bits are the interrupt disable bits. When set, these disable the IRQ and FIQ
interrupts respectively.
The mode bits
The M4, M3, M2, M1 and M0 bits (M[4:0]) are the mode bits. These determine the
processor's operating mode, as shown in Table 2-1. Not all combinations of the mode bits
define a valid processor mode. Only those explicitly described shall be used. The user
should be aware that if any illegal value is programmed into the mode bits, M[4:0], then the
processor will enter an unrecoverable state. If this occurs, reset should be applied.
Reserved bitsThe remaining bits in the PSRs are reserved. When changing a PSR's flag or control bits,
you must ensure that these unused bits are not altered. Also, your program should not rely
on them containing specific values, since in future processors they may read as one or
zero.
2-8
S3C44B0X RISC MICROPROCESSORPROGRAMMER'S MODEL
Table 2-1. PSR Mode Bit Values
M[4:0]ModeVisible THUMB state registersVisible ARM state registers
10000UserR7..R0,
LR, SP
R14..R0,
PC, CPSR
PC, CPSR
10001FIQR7..R0,
LR_fiq, SP_fiq
PC, CPSR, SPSR_fiq
10010IRQR7..R0,
LR_irq, SP_irq
PC, CPSR, SPSR_irq
10011SupervisorR7..R0,
LR_svc, SP_svc,
PC, CPSR, SPSR_svc
10111AbortR7..R0,
LR_abt, SP_abt,
PC, CPSR, SPSR_abt
11011UndefinedR7..R0
LR_und, SP_und,
PC, CPSR, SPSR_und
11111SystemR7..R0,
LR, SP
R7..R0,
R14_fiq..R8_fiq,
PC, CPSR, SPSR_fiq
R12..R0,
R14_irq, R13_irq,
PC, CPSR, SPSR_irq
R12..R0,
R14_svc, R13_svc,
PC, CPSR, SPSR_svc
R12..R0,
R14_abt, R13_abt,
PC, CPSR, SPSR_abt
R12..R0,
R14_und, R13_und,
PC, CPSR
R14..R0,
PC, CPSR
PC, CPSR
Reserved bits The remaining bits in the PSR's are reserved. When changing a PSR's flag or control bits,
you must ensure that these unused bits are not altered. Also, your program should not rely
on them containing specific values, since in future processors they may read as one or
zero.
2-9
PROGRAMMER'S MODELS3C44B0X RISC MICROPROCESSOR
EXCEPTIONS
Exceptions arise whenever the normal flow of a program has to be halted temporarily, for example to service an
interrupt from a peripheral. Before an exception can be handled, the current processor state must be preserved
so that the original program can resume when the handler routine has finished.
It is possible for several exceptions to arise at the same time. If this happens, they are dealt with in a fixed order.
See Exception Priorities on page 2-14.
Action on Entering an Exception
When handling an exception, the ARM7TDMI:
1. Preserves the address of the next instruction in the appropriate Link Register. If the exception has been
entered from ARM state, then the address of the next instruction is copied into the Link Register (that is,
current PC + 4 or PC + 8 depending on the exception. See Table 2-2 on for details). If the exception has
been entered from THUMB state, then the value written into the Link Register is the current PC offset by a
value such that the program resumes from the correct place on return from the exception. This means that
the exception handler need not determine which state the exception was entered from. For example, in the
case of SWI, MOVS PC, R14_svc will always return to the next instruction regardless of whether the SWI
was executed in ARM or THUMB state.
2. Copies the CPSR into the appropriate SPSR
3. Forces the CPSR mode bits to a value which depends on the exception
4. Forces the PC to fetch the next instruction from the relevant exception vector
It may also set the interrupt disable flags to prevent otherwise unmanageable nestings of exceptions.
If the processor is in THUMB state when an exception occurs, it will automatically switch into ARM state when the
PC is loaded with the exception vector address.
Action on Leaving an Exception
On completion, the exception handler:
1. Moves the Link Register, minus an offset where appropriate, to the PC. (The offset will vary depending on the
type of exception.)
2. Copies the SPSR back to the CPSR
3. Clears the interrupt disable flags, if they were set on entry
NOTE
An explicit switch back to THUMB state is never needed, since restoring the CPSR from the SPSR
automatically sets the T bit to the value it held immediately prior to the exception.
2-10
S3C44B0X RISC MICROPROCESSORPROGRAMMER'S MODEL
Exception Entry/Exit Summary
Table 2-2 summarises the PC value preserved in the relevant R14 on exception entry, and the recommended
instruction for exiting the exception handler.
1. Where PC is the address of the BL/SWI/Undefined Instruction fetch which had the prefetch abort.
2. Where PC is the address of the instruction which did not get executed since the FIQ or IRQ took priority.
3. Where PC is the address of the Load or Store instruction which generated the data abort.
4. The value saved in R14_svc upon reset is unpredictable.
FIQ
The FIQ (Fast Interrupt Request) exception is designed to support a data transfer or channel process, and in
ARM state has sufficient private registers to remove the need for register saving (thus minimising the overhead
of context switching).
FIQ is externally generated by taking the nFIQ input LOW. This input can except either synchronous or
asynchronous transitions, depending on the state of the ISYNC input signal. When ISYNC is LOW, nFIQ and
nIRQ are considered asynchronous, and a cycle delay for synchronization is incurred before the interrupt can
affect the processor flow.
Irrespective of whether the exception was entered from ARM or Thumb state, a FIQ handler should leave the
interrupt by executing
SUBS PC,R14_fiq,#4
FIQ may be disabled by setting the CPSR's F flag (but note that this is not possible from User mode). If the F flag
is clear, ARM7TDMI checks for a LOW level on the output of the FIQ synchroniser at the end of each instruction.
2-11
PROGRAMMER'S MODELS3C44B0X RISC MICROPROCESSOR
IRQ
The IRQ (Interrupt Request) exception is a normal interrupt caused by a LOW level on the nIRQ input. IRQ has a
lower priority than FIQ and is masked out when a FIQ sequence is entered. It may be disabled at any time by
setting the I bit in the CPSR, though this can only be done from a privileged (non-User) mode.
Irrespective of whether the exception was entered from ARM or Thumb state, an IRQ handler should return from
the interrupt by executing
SUBSPC,R14_irq,#4
Abort
An abort indicates that the current memory access cannot be completed. It can be signalled by the external
ABORT input. ARM7TDMI checks for the abort exception during memory access cycles.
There are two types of abort:
•Prefetch abort: occurs during an instruction prefetch.
•Data abort: occurs during a data access.
If a prefetch abort occurs, the prefetched instruction is marked as invalid, but the exception will not be taken until
the instruction reaches the head of the pipeline. If the instruction is not executed - for example because a branch
occurs while it is in the pipeline - the abort does not take place.
If a data abort occurs, the action taken depends on the instruction type:
•Single data transfer instructions (LDR, STR) write back modified base registers: the Abort handler must be
aware of this.
•The swap instruction (SWP) is aborted as though it had not been executed.
•Block data transfer instructions (LDM, STM) complete. If write-back is set, the base is updated. If the
instruction would have overwritten the base with data (ie it has the base in the transfer list), the overwriting is
prevented. All register overwriting is prevented after an abort is indicated, which means in particular that R15
(always the last register to be transferred) is preserved in an aborted LDM instruction.
The abort mechanism allows the implementation of a demand paged virtual memory system. In such a system
the processor is allowed to generate arbitrary addresses. When the data at an address is unavailable, the
Memory Management Unit (MMU) signals an abort. The abort handler must then work out the cause of the abort,
make the requested data available, and retry the aborted instruction. The application program needs no
knowledge of the amount of memory available to it, nor is its state in any way affected by the abort.
After fixing the reason for the abort, the handler should execute the following irrespective of the state (ARM or
Thumb):
SUBS PC,R14_abt,#4; for a prefetch abort, or
SUBS PC,R14_abt,#8; for a data abort
This restores both the PC and the CPSR, and retries the aborted instruction.
2-12
S3C44B0X RISC MICROPROCESSORPROGRAMMER'S MODEL
Software Interrupt
The software interrupt instruction (SWI) is used for entering Supervisor mode, usually to request a particular
supervisor function. A SWI handler should return by executing the following irrespective of the state (ARM or
Thumb):
MOV PC,R14_svc
This restores the PC and CPSR, and returns to the instruction following the SWI.
NOTE
nFIQ, nIRQ, ISYNC, LOCK, BIGEND, and ABORT pins exist only in the ARM7TDMI CPU core.
Undefined Instruction
When ARM7TDMI comes across an instruction which it cannot handle, it takes the undefined instruction trap.
This mechanism may be used to extend either the THUMB or ARM instruction set by software emulation.
After emulating the failed instruction, the trap handler should execute the following irrespective of the state (ARM
or Thumb):
MOVS PC,R14_und
This restores the CPSR and returns to the instruction following the undefined instruction.
Exception Vectors
The following table shows the exception vector addresses.
When multiple exceptions arise at the same time, a fixed priority system determines the order in which they are
handled:
Highest priority:
1. Reset
2. Data abort
3. FIQ
4. IRQ
5. Prefetch abort
Lowest priority:
6. Undefined Instruction, Software interrupt.
Not All Exceptions Can Occur at Once:
Undefined Instruction and Software Interrupt are mutually exclusive, since they each correspond to particular
(non-overlapping) decodings of the current instruction.
If a data abort occurs at the same time as a FIQ, and FIQs are enabled (ie the CPSR's F flag is clear),
ARM7TDMI enters the data abort handler and then immediately proceeds to the FIQ vector. A normal return from
FIQ will cause the data abort handler to resume execution. Placing data abort at a higher priority than FIQ is
necessary to ensure that the transfer error does not escape detection. The time for this exception entry should be
added to worst-case FIQ latency calculations.
2-14
S3C44B0X RISC MICROPROCESSORPROGRAMMER'S MODEL
INTERRUPT LATENCIES
The worst case latency for FIQ, assuming that it is enabled, consists of the longest time the request can take to
pass through the synchroniser (Tsyncmax if asynchronous), plus the time for the longest instruction to complete
(Tldm, the longest instruction is an LDM which loads all the registers including the PC), plus the time for the data
abort entry (Texc), plus the time for FIQ entry (Tfiq). At the end of this time ARM7TDMI will be executing the
instruction at 0x1C.
Tsyncmax is 3 processor cycles, Tldm is 20 cycles, Texc is 3 cycles, and Tfiq is 2 cycles. The total time is
therefore 28 processor cycles. This is just over 1.4 microseconds in a system which uses a continuous 20 MHz
processor clock. The maximum IRQ latency calculation is similar, but must allow for the fact that FIQ has higher
priority and could delay entry into the IRQ handling routine for an arbitrary length of time. The minimum latency
for FIQ or IRQ consists of the shortest time the request can take through the synchroniser (Tsyncmin) plus Tfiq.
This is 4 processor cycles.
RESET
When the nRESET signal goes LOW, ARM7TDMI abandons the executing instruction and then continues to
fetch instructions from incrementing word addresses.
When nRESET goes HIGH again, ARM7TDMI:
1. Overwrites R14_svc and SPSR_svc by copying the current values of the PC and CPSR into them. The value
of the saved PC and SPSR is not defined.
2. Forces M[4:0] to 10011 (Supervisor mode), sets the I and F bits in the CPSR, and clears the CPSR's T bit.
3. Forces the PC to fetch the next instruction from address 0x00.
4. Execution resumes in ARM state.
2-15
PROGRAMMER'S MODELS3C44B0X RISC MICROPROCESSOR
NOTES
2-16
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
3INSTRUCTION SET
INSTRUCTION SET SUMMAY
This chapter describes the ARM instruction set and the THUMB instruction set in the ARM7TDMI core.
Some instruction codes are not defined but do not cause the Undefined instruction trap to be taken, for
instance a Multiply instruction with bit 6 changed to a 1. These instructions should not be used, as their
action may change in future ARM implementations.
INSTRUCTION SUMMARY
Table 3-1. The ARM Instruction Set
MnemonicInstructionAction
ADCAdd with carryRd: = Rn + Op2 + Carry
ADDAddRd: = Rn + Op2
ANDANDRd: = Rn AND Op2
BBranchR15: = address
BICBit ClearRd: = Rn AND NOT Op2
BLBranch with LinkR14: = R15, R15: = address
BXBranch and ExchangeR15: = Rn, T bit: = Rn[0]
CDPCoprocessor Data Processing(Coprocessor-specific)
CMNCompare NegativeCPSR flags: = Rn + Op2
CMPCompareCPSR flags: = Rn - Op2
EORExclusive ORRd: = (Rn AND NOT Op2)
OR (Op2 AND NOT Rn)
LDCLoad coprocessor from memoryCoprocessor load
LDMLoad multiple registersStack manipulation (Pop)
LDRLoad register from memoryRd: = (address)
MCRMove CPU register to coprocessor
In ARM state, all instructions are conditionally executed according to the state of the CPSR condition codes and
the instruction's condition field. This field (bits 31:28) determines the circumstances under which an instruction is
to be executed. If the state of the C, N, Z and V flags fulfils the conditions encoded by the field, the instruction is
executed, otherwise it is ignored.
There are sixteen possible conditions, each represented by a two-character suffix that can be appended to the
instruction's mnemonic. For example, a Branch (B in assembly language) becomes BEQ for "Branch if Equal",
which means the Branch will only be taken if the Z flag is set.
In practice, fifteen different conditions may be used: these are listed in Table 3-2. The sixteenth (1111) is
reserved, and must not be used.
In the absence of a suffix, the condition field of most instructions is set to "Always" (suffix AL). This means the
instruction will always be executed regardless of the CPSR condition codes.
Table 3-2. Condition Code Summary
CodeSuffixFlagsMeaning
0000EQZ setequal
0001NEZ clearnot equal
0010CSC setunsigned higher or same
0011CCC clearunsigned lower
0100MIN setnegative
0101PLN clearpositive or zero
0110VSV setoverflow
0111VCV clearno overflow
1000HIC set and Z clearunsigned higher
1001LSC clear or Z setunsigned lower or same
1010GEN equals Vgreater or equal
1011LTN not equal to Vless than
1100GTZ clear AND (N equals V)greater than
1101LEZ set OR (N not equal to V)less than or equal
1110AL(ignored)always
3-4
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
BRANCH AND EXCHANGE (BX)
This instruction is only executed if the condition is true. The various conditions are defined in Table 3-2.
This instruction performs a branch by copying the contents of a general register, Rn, into the program counter,
PC. The branch causes a pipeline flush and refill from the address specified by Rn. This instruction also permits
the instruction set to be exchanged. When the instruction is executed, the value of Rn[0] determines whether the
instruction stream will be decoded as ARM or THUMB instructions.
31242719158 70
2816111223204 3
CondRn
00 0110 0011 1111 1111 1100 01
[3:0] Operand Register
If bit0 of Rn = 1, subsequent instructions decoded as THUMB instructions
If bit0 of Rn =0, subsequent instructions decoded as ARM instructions
[31:28] Condition Field
Figure 3-2. Branch and Exchange Instructions
INSTRUCTION CYCLE TIMES
The BX instruction takes 2S + 1N cycles to execute, where S and N are defined as sequential (S-cycle) and nonsequential (N-cycle), respectively.
ASSEMBLER SYNTAX
BX - branch and exchange.
BX {cond} Rn
{cond}Two character condition mnemonic. See Table 3-2.
Rnis an expression evaluating to a valid register number.
USING R15 AS AN OPERAND
If R15 is used as an operand, the behavior is undefined.
; and set bit 0 high - hence
; arrive in THUMB state.
BXR0; Branch and change to THUMB
; state.
CODE16; Assemble subsequent code as
Into_THUMB; THUMB instructions
•
•
•
ADR R5, Back_to_ARM; Generate branch target to word aligned address
; - hence bit 0 is low and so change back to ARM state.
BX R5; Branch and change back to ARM state.
•
•
•
ALIGN; Word align
CODE32; Assemble subsequent code as ARM instructions
Back_to_ARM
3-6
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
BRANCH AND BRANCH WITH LINK (B, BL)
The instruction is only executed if the condition is true. The various conditions are defined Table 3-2. The
instruction encoding is shown in Figure 3-3, below.
312427
2823
CondOffset
101
25
L
0
[24] Link bit
0 = Branch1 = Branch with link
[31:28] Condition Field
Figure 3-3. Branch Instructions
Branch instructions contain a signed 2's complement 24 bit offset. This is shifted left two bits, sign extended to 32
bits, and added to the PC. The instruction can therefore specify a branch of +/- 32Mbytes. The branch offset must
take account of the prefetch operation, which causes the PC to be 2 words (8 bytes) ahead of the current
instruction.
Branches beyond +/- 32Mbytes must use an offset or absolute destination which has been previously loaded into
a register. In this case the PC should be manually saved in R14 if a Branch with Link type operation is required.
THE LINK BIT
Branch with Link (BL) writes the old PC into the link register (R14) of the current bank. The PC value written into
R14 is adjusted to allow for the prefetch, and contains the address of the instruction following the branch and link
instruction. Note that the CPSR is not saved with the PC and R14[1:0] are always cleared.
To return from a routine called by Branch with Link use MOV PC,R14 if the link register is still valid or LDM
Rn!,{..PC} if the link register has been saved onto a stack pointed to by Rn.
INSTRUCTION CYCLE TIMES
Branch and Branch with Link instructions take 2S + 1N incremental cycles, where S and N are defined as
sequential (S-cycle) and internal (I-cycle).
3-7
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
ASSEMBLER SYNTAX
Items in {} are optional. Items in <> must be present.
B{L}{cond} <expression>
{L} Used to request the Branch with Link form of the instruction. If absent, R14 will not be
affected by the instruction.
{cond} A two-character mnemonic as shown in Table 3-2. If absent then AL (ALways) will be
used.
<expression> The destination. The assembler calculates the offset.
EXAMPLES
hereBALhere; Assembles to 0xEAFFFFFE (note effect of PC offset).
Bthere; Always condition used as default.
CMP R1,#0 ; Compare R1 with zero and branch to fred
; if R1 was zero, otherwise continue.
BEQ fred; Continue to next instruction.
BL sub+ROM; Call subroutine at computed address.
ADDS R1,#1; Add 1 to register 1, setting CPSR flags
; on the result then call subroutine if
BLCC sub; the C flag is clear, which will be the
; case unless R1 held 0xFFFFFFFF.
3-8
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
DATA PROCESSING
The data processing instruction is only executed if the condition is true. The conditions are defined in Table 3-2.
The instruction encoding is shown in Figure 3-4.
3124271915
2816111221
26 25
CondOperand2
00L20OpCodeSRnRd
[15:12] Destination register
0 = Branch1 = Branch with link
[19:16] 1st operand register
0 = Branch1 = Branch with link
[20] Set condition codes
0 = Do not after condition codes1 = Set condition codes
0 = Operand 2 is a register1 = Operand 2 is an immediate value
[11:0] Operand 2 type selection
31104
Shift
[3:0] 2nd operand register[11:4] Shift applied to Rm
81107
Rotate
[7:0] Unsigned 8 bit immediate value[11:8] Shift applied to Imm
Imm
Rm
[31:28] Condition field
Figure 3-4. Data Processing Instructions
3-9
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
The instruction produces a result by performing a specified arithmetic or logical operation on one or two
operands. The first operand is always a register (Rn).
The second operand may be a shifted register (Rm) or a rotated 8 bit immediate value (Imm) according to the
value of the I bit in the instruction. The condition codes in the CPSR may be preserved or updated as a result of
this instruction, according to the value of the S bit in the instruction.
Certain operations (TST, TEQ, CMP, CMN) do not write the result to Rd. They are used only to perform tests and
to set the condition codes on the result and always have the S bit set. The instructions and their effects are listed
in Table 3-3.
3-10
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
CPSR FLAGS
The data processing operations may be classified as logical or arithmetic. The logical operations (AND, EOR,
TST, TEQ, ORR, MOV, BIC, MVN) perform the logical action on all corresponding bits of the operand or
operands to produce the result. If the S bit is set (and Rd is not R15, see below) the V flag in the CPSR will be
unaffected, the C flag will be set to the carry out from the barrel shifter (or preserved when the shift operation is
LSL #0), the Z flag will be set if and only if the result is all zeros, and the N flag will be set to the logical value of
bit 31 of the result.
Table 3-3. ARM Data Processing Instructions
Assembler MnemonicOP CodeAction
AND0000Operand1 AND operand2
EOR0001Operand1 EOR operand2
TEQ1001As EOR, but result is not written
CMP1010As SUB, but result is not written
CMN1011As ADD, but result is not written
ORR1100Operand1 OR operand2
MOV1101Operand2 (operand1 is ignored)
BIC1110Operand1 AND NOT operand2 (Bit clear)
MVN1111NOT operand2 (operand1 is ignored)
The arithmetic operations (SUB, RSB, ADD, ADC, SBC, RSC, CMP, CMN) treat each operand as a 32 bit integer
(either unsigned or 2's complement signed, the two are equivalent). If the S bit is set (and Rd is not R15) the V
flag in the CPSR will be set if an overflow occurs into bit 31 of the result; this may be ignored if the operands
were considered unsigned, but warns of a possible error if the operands were 2's complement signed. The C flag
will be set to the carry out of bit 31 of the ALU, the Z flag will be set if and only if the result was zero, and the N
flag will be set to the value of bit 31 of the result (indicating a negative result if the operands are considered to be
2's complement signed).
3-11
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
SHIFTS
When the second operand is specified to be a shifted register, the operation of the barrel shifter is controlled by
the Shift field in the instruction. This field indicates the type of shift to be performed (logical left or right,
arithmetic right or rotate right). The amount by which the register should be shifted may be contained in an
immediate field in the instruction, or in the bottom byte of another register (other than R15). The encoding for the
different shift types is shown in Figure 3-5.
456711
0
[6:5] Shift type
00 = logical left 01 = logical right
10 = arithmetic right 11 = rotate right
[11:7] Shift amount
5 bit unsigned integer
0RS
[6:5] Shift type
00 = logical left 01 = logical right
10 = arithmetic right 11 = rotate right
[11:8] Shift register
Shift amount specified in bottom-byte of Rs
4567118
1
Figure 3-5. ARM Shift Operations
Instruction specified shift amount
When the shift amount is specified in the instruction, it is contained in a 5 bit field which may take any value from
0 to 31. A logical shift left (LSL) takes the contents of Rm and moves each bit by the specified amount to a more
significant position. The least significant bits of the result are filled with zeros, and the high bits of Rm which do
not map into the result are discarded, except that the least significant discarded bit becomes the shifter carry
output which may be latched into the C bit of the CPSR when the ALU operation is in the logical class (see
above). For example, the effect of LSL #5 is shown in Figure 3-6.
3127 26
Contents of Rm
carry out
Value of Operand 2
Figure 3-6. Logical Shift Left
NOTE
LSL #0 is a special case, where the shifter carry out is the old value of the CPSR C flag. The contents of
Rm are used directly as the second operand. A logical shift right (LSR) is similar, but the contents of Rm
are moved to less significant positions in the result. LSR #5 has the effect shown in Figure 3-7.
3-12
000000
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
31
45
Contents of Rm
00000
Value of Operand 2
0
carry out
Figure 3-7. Logical Shift Right
The form of the shift field which might be expected to correspond to LSR #0 is used to encode LSR #32, which
has a zero result with bit 31 of Rm as the carry output. Logical shift right zero is redundant as it is the same as
logical shift left zero, so the assembler will convert LSR #0 (and ASR #0 and ROR #0) into LSL #0, and allow
LSR #32 to be specified.
An arithmetic shift right (ASR) is similar to logical shift right, except that the high bits are filled with bit 31 of Rm
instead of zeros. This preserves the sign in 2's complement notation. For example, ASR #5 is shown in Figure
3-8.
31
4530
Contents of Rm
Value of Operand 2
0
carry out
Figure 3-8. Arithmetic Shift Right
The form of the shift field which might be expected to give ASR #0 is used to encode ASR #32. Bit 31 of Rm is
again used as the carry output, and each bit of operand 2 is also equal to bit 31 of Rm. The result is therefore all
ones or all zeros, according to the value of bit 31 of Rm.
3-13
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
Rotate right (ROR) operations reuse the bits which "overshoot" in a logical shift right operation by reintroducing
them at the high end of the result, in place of the zeros used to fill the high end in logical right operations. For
example, ROR #5 is shown in Figure 3-9.
31
45
Contents of Rm
Value of Operand 2
0
carry out
Figure 3-9. Rotate Right
The form of the shift field which might be expected to give ROR #0 is used to encode a special function of the
barrel shifter, rotate right extended (RRX). This is a rotate right by one bit position of the 33 bit quantity formed by
appending the CPSR C flag to the most significant end of the contents of Rm as shown in Figure 3-10.
31
Contents of Rm
C
in
01
carry out
3-14
Value of Operand 2
Figure 3-10. Rotate Right Extended
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
Register specified shift amount
Only the least significant byte of the contents of Rs is used to determine the shift amount. Rs can be any general
register other than R15.
If this byte is zero, the unchanged contents of Rm will be used as the second operand, and the old value of the
CPSR C flag will be passed on as the shifter carry output.
If the byte has a value between 1 and 31, the shifted result will exactly match that of an instruction specified shift
with the same value and shift operation.
If the value in the byte is 32 or more, the result will be a logical extension of the shift described above:
1. LSL by 32 has result zero, carry out equal to bit 0 of Rm.
2. LSL by more than 32 has result zero, carry out zero.
3. LSR by 32 has result zero, carry out equal to bit 31 of Rm.
4. LSR by more than 32 has result zero, carry out zero.
5. ASR by 32 or more has result filled with and carry out equal to bit 31 of Rm.
6. ROR by 32 has result equal to Rm, carry out equal to bit 31 of Rm.
7. ROR by n where n is greater than 32 will give the same result and carry out as ROR by n-32; therefore
repeatedly subtract 32 from n until the amount is in the range 1 to 32 and see above.
NOTE
The zero in bit 7 of an instruction with a register controlled shift is compulsory; a one in this bit will cause
the instruction to be a multiply or undefined instruction.
3-15
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
IMMEDIATE OPERAND ROTATES
The immediate operand rotate field is a 4 bit unsigned integer which specifies a shift operation on the 8 bit
immediate value. This value is zero extended to 32 bits, and then subject to a rotate right by twice the value in
the rotate field. This enables many common constants to be generated, for example all powers of 2.
WRITING TO R15
When Rd is a register other than R15, the condition code flags in the CPSR may be updated from the ALU flags
as described above.
When Rd is R15 and the S flag in the instruction is not set the result of the operation is placed in R15 and the
CPSR is unaffected.
When Rd is R15 and the S flag is set the result of the operation is placed in R15 and the SPSR corresponding to
the current mode is moved to the CPSR. This allows state changes which atomically restore both PC and CPSR.
This form of instruction should not be used in User mode.
USING R15 AS AN OPERANDY
If R15 (the PC) is used as an operand in a data processing instruction the register is used directly.
The PC value will be the address of the instruction, plus 8 or 12 bytes due to instruction prefetching. If the shift
amount is specified in the instruction, the PC will be 8 bytes ahead. If a register is used to specify the shift
amount the PC will be 12 bytes ahead.
TEQ, TST, CMP AND CMN OPCODES
NOTE
TEQ, TST, CMP and CMN do not write the result of their operation but do set flags in the CPSR. An
assembler should always set the S flag for these instructions even if this is not specified in the
mnemonic.
The TEQP form of the TEQ instruction used in earlier ARM processors must not be used: the PSR transfer
operations should be used instead.
The action of TEQP in the ARM7TDMI is to move SPSR_<mode> to the CPSR if the processor is in a privileged
mode and to do nothing if in User mode.
INSTRUCTION CYCLE TIMES
Data Processing instructions vary in the number of incremental cycles taken as follows:
Table 3-4. Incremental Cycle Times
Processing TypeCycles
Normal data processing1S
Data processing with register specified shift1S + 1I
Data processing with PC written2S + 1N
Data processing with register specified shift and PC written2S + 1N +1I
NOTE: S, N and I are as defined sequential (S-cycle), non-sequential (N-cycle), and internal (I-cycle) respectively.
3-16
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
ASSEMBLER SYNTAX
••MOV,MVN (single operand instructions).
<opcode>{cond}{S} Rd,<Op2>
••CMP,CMN,TEQ,TST (instructions which do not produce a result).
<opcode>{cond} Rn,<Op2>
••AND,EOR,SUB,RSB,ADD,ADC,SBC,RSC,ORR,BIC
<opcode>{cond}{S} Rd,Rn,<Op2>
where:
<Op2>Rm{,<shift>} or,<#expression>
{cond}A two-character condition mnemonic. See Table 3-2.
{S}Set condition codes if S present (implied for CMP, CMN, TEQ, TST).
Rd, Rn and Rm Expressions evaluating to a register number.
<#expression>If this is used, the assembler will attempt to generate a shifted immediate 8-bit field to
match the expression. If this is impossible, it will give an error.
<shift><Shiftname> <register> or <shiftname> #expression, or RRX (rotate right one bit with
extend).
<shiftname>sASL, LSL, LSR, ASR, ROR. (ASL is a synonym for LSL, they assemble to the same
code.)
EXAMPLES
ADDEQR2,R4,R5; If the Z flag is set make R2:=R4+R5
TEQSR4,#3; Test R4 for equality with 3.
; (The S is in fact redundant as the
; assembler inserts it automatically.)
SUBR4,R5,R7,LSR R2; Logical right shift R7 by the number in
; the bottom byte of R2, subtract result
; from R5, and put the answer into R4.
MOVPC,R14; Return from subroutine.
MOVSPC,R14; Return from exception and restore CPSR
; from SPSR_mode.
3-17
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
PSR TRANSFER (MRS, MSR)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2.
The MRS and MSR instructions are formed from a subset of the Data Processing operations and are
implemented using the TEQ, TST, CMN and CMP instructions without the S flag set. The encoding is shown in
Figure 3-11.
These instructions allow access to the CPSR and SPSR registers. The MRS instruction allows the contents of the
CPSR or SPSR_<mode> to be moved to a general register. The MSR instruction allows the contents of a general
register to be moved to the CPSR or SPSR_<mode> register.
The MSR instruction also allows an immediate value or register contents to be transferred to the condition code
flags (N,Z,C and V) of CPSR or SPSR_<mode> without affecting the control bits. In this case, the top four bits of
the specified register contents or 32 bit immediate value are written to the top four bits of the relevant PSR.
OPERAND RESTRICTIONS
••In user mode, the control bits of the CPSR are protected from change, so only the condition code flags of the
CPSR can be changed. In other (privileged) modes the entire CPSR can be changed.
••Note that the software must never change the state of the T bit in the CPSR. If this happens, the processor
will enter an unpredictable state.
••The SPSR register which is accessed depends on the mode at the time of execution. For example, only
SPSR_fiq is accessible when the processor is in FIQ mode.
••You must not specify R15 as the source or destination register.
••Also, do not attempt to access an SPSR in User mode, since no such register exists.
3-18
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
MRS (transfer PSR contents to a register)
31222715281611122123
Cond000000000000
00010Rd
Ps
001111
0
[15:21] Destination Register
[19:16] Source PSR
0 = CPSR1 = SPSR_<current mode>
[31:28] Condition Field
MRS (transfer register contents to PSR)
3122272811122123
Cond00000000
00010
Pd
101001111
4 30
Rm
[3:0] Source Register
[22] Destination PSR
0 = CPSR1 = SPSR_<current mode>
[31:28] Condition Field
MRS (transfer register contents or immediate value to PSR flag bits only)
3122272811122123
CondSource operand
26 25 240
I1000
Pd
101001111
[22] Destination PSR
0 = CPSR1 = SPSR_<current mode>
[25] Immediate Operand
0 = Source operand is a register
1 = SPSR_<current mode>
[11:0] Source Operand
114 30
00000000Rm
[3:0] Source Register
[11:4] Source operand is an immediate value
1108 7
RotateImm
[7:0] Unsigned 8 bit immediate value
[11:8] Shift applied to Imm
[31:28] Condition Field
Figure 3-11. PSR Transfer
3-19
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
RESERVED BITS
Only twelve bits of the PSR are defined in ARM7TDMI (N,Z,C,V,I,F, T & M[4:0]); the remaining bits are reserved
for use in future versions of the processor. Refer to Figure 2-6 for a full description of the PSR bits.
To ensure the maximum compatibility between ARM7TDMI programs and future processors, the following rules
should be observed:
•The reserved bits should be preserved when changing the value in a PSR.
•Programs should not rely on specific values from the reserved bits when checking the PSR status, since they
may read as one or zero in future processors.
A read-modify-write strategy should therefore be used when altering the control bits of any PSR register; this
involves transferring the appropriate PSR register to a general register using the MRS instruction, changing only
the relevant bits and then transferring the modified value back to the PSR register using the MSR instruction.
EXAMPLES
The following sequence performs a mode change:
MRSR0,CPSR; Take a copy of the CPSR.
BICR0,R0,#0x1F; Clear the mode bits.
ORRR0,R0,#new_mode; Select new mode
MSRCPSR,R0; Write back the modified CPSR.
When the aim is simply to change the condition code flags in a PSR, a value can be written directly to the flag
bits without disturbing the control bits. The following instruction sets the N,Z,C and V flags:
MSRCPSR_flg,#0xF0000000; Set all the flags regardless of their previous state
; (does not affect any control bits).
No attempt should be made to write an 8 bit immediate value into the whole PSR since such an operation cannot
preserve the reserved bits.
INSTRUCTION CYCLE TIMES
PSR transfers take 1S incremental cycles, where S is defined as Sequential (S-cycle).
3-20
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
ASSEMBLY SYNTAX
••MRS - transfer PSR contents to a register
MRS{cond} Rd,<psr>
••MSR - transfer register contents to PSR
MSR{cond} <psr>,Rm
••MSR - transfer register contents to PSR flag bits only
MSR{cond} <psrf>,Rm
The most significant four bits of the register contents are written to the N,Z,C & V flags respectively.
••MSR - transfer immediate value to PSR flag bits only
MSR{cond} <psrf>,<#expression>
The expression should symbolise a 32 bit value of which the most significant four bits are written to the N,Z,C
and V flags respectively.
Key:
{cond}Two-character condition mnemonic. See Table 3-2..
Rd and Rm Expressions evaluating to a register number other than R15
<psr>CPSR, CPSR_all, SPSR or SPSR_all. (CPSR and CPSR_all are synonyms as are SPSR
and SPSR_all)
<psrf>CPSR_flg or SPSR_flg
<#expression>Where this is used, the assembler will attempt to generate a shifted immediate 8-bit field
to match the expression. If this is impossible, it will give an error.
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-12.
The multiply and multiply-accumulate instructions use an 8 bit Booth's algorithm to perform integer multiplication.
0 = Do not after condition codes
1 = Set condition codes
[21] Accumulate
0 = Multiply only
1 = Multiply and accumulate
[31:28] Condition Field
Figure 3-12. Multiply Instructions
The multiply form of the instruction gives Rd:=Rm*Rs. Rn is ignored, and should be set to zero for compatibility
with possible future upgrades to the instruction set. The multiply-accumulate form gives Rd:=Rm*Rs+Rn, which
can save an explicit ADD instruction in some circumstances. Both forms of the instruction work on operands
which may be considered as signed (2's complement) or unsigned integers.
The results of a signed multiply and of an unsigned multiply of 32 bit operands differ only in the upper 32 bits the low 32 bits of the signed and unsigned results are identical. As these instructions only produce the low 32 bits
of a multiply, they can be used for both signed and unsigned multiplies.
For example consider the multiplication of the operands:
Operand AOperand BResult
0xFFFFFFF6 0x00000010xFFFFFF38
3-22
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
If the Operands Are Interpreted as Signed
Operand A has the value -10, operand B has the value 20, and the result is -200 which is correctly represented as
0xFFFFFF38.
If the Operands Are Interpreted as Unsigned
Operand A has the value 4294967286, operand B has the value 20 and the result is 85899345720, which is
represented as 0x13FFFFFF38, so the least significant 32 bits are 0xFFFFFF38.
Operand Restrictions
The destination register Rd must not be the same as the operand register Rm. R15 must not be used as an
operand or as the destination register.
All other register combinations will give correct results, and Rd, Rn and Rs may use the same register when
required.
3-23
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
CPSR FLAGS
Setting the CPSR flags is optional, and is controlled by the S bit in the instruction. The N (Negative) and Z (Zero)
flags are set correctly on the result (N is made equal to bit 31 of the result, and Z is set if and only if the result is
zero). The C (Carry) flag is set to a meaningless value and the V (oVerflow) flag is unaffected.
INSTRUCTION CYCLE TIMES
MUL takes 1S + mI and MLA 1S + (m+1)I cycles to execute, where S and I are defined as sequential (S-cycle)
and internal (I-cycle), respectively.
mThe number of 8 bit multiplier array cycles is required to complete the multiply, which is
controlled by the value of the multiplier operand specified by Rs. Its possible values are
as follows
1If bits [32:8] of the multiplier operand are all zero or all one.
2If bits [32:16] of the multiplier operand are all zero or all one.
3If bits [32:24] of the multiplier operand are all zero or all one.
4 In all other cases.
ASSEMBLER SYNTAX
MUL{cond}{S} Rd,Rm,Rs
MLA{cond}{S} Rd,Rm,Rs,Rn
{cond} Two-character condition mnemonic. See Table 3-2..
{S}Set condition codes if S present
Rd, Rm, Rs and RnExpressions evaluating to a register number other than R15.
MULTIPLY LONG AND MULTIPLY-ACCUMULATE LONG (MULL, MLAL)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-13.
The multiply long instructions perform integer multiplication on two 32 bit operands and produce 64 bit results.
Signed and unsigned multiplication each with optional accumulate give rise to four variations.
0 = Do not alter condition codes
1 = Set condition codes
[21] Accumulate
0 = Multiply only
1 = Multiply and accumulate
[22] Unsigned
0 = Unsigned
1 = Signed
[31:28] Condition Field
Figure 3-13. Multiply Long Instructions
8 74 30
RsRmA
1 0 0 1
The multiply forms (UMULL and SMULL) take two 32 bit numbers and multiply them to produce a 64 bit result of
the form RdHi,RdLo := Rm * Rs. The lower 32 bits of the 64 bit result are written to RdLo, the upper 32 bits of the
result are written to RdHi.
The multiply-accumulate forms (UMLAL and SMLAL) take two 32 bit numbers, multiply them and add a 64 bit
number to produce a 64 bit result of the form RdHi,RdLo := Rm * Rs + RdHi,RdLo. The lower 32 bits of the 64 bit
number to add is read from RdLo. The upper 32 bits of the 64 bit number to add is read from RdHi. The lower 32
bits of the 64 bit result are written to RdLo. The upper 32 bits of the 64 bit result are written to RdHi.
The UMULL and UMLAL instructions treat all of their operands as unsigned binary numbers and write an
unsigned 64 bit result. The SMULL and SMLAL instructions treat all of their operands as two's-complement
signed numbers and write a two's-complement signed 64 bit result.
3-25
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
OPERAND RESTRICTIONS
••R15 must not be used as an operand or as a destination register.
••RdHi, RdLo, and Rm must all specify different registers.
CPSR FLAGS
Setting the CPSR flags is optional, and is controlled by the S bit in the instruction. The N and Z flags are set
correctly on the result (N is equal to bit 63 of the result, Z is set if and only if all 64 bits of the result are zero).
Both the C and V flags are set to meaningless values.
INSTRUCTION CYCLE TIMES
MULL takes 1S + (m+1)I and MLAL 1S + (m+2)I cycles to execute, where m is the number of 8 bit multiplier
array cycles required to complete the multiply, which is controlled by the value of the multiplier operand specified
by Rs.
Its possible values are as follows:
For Signed INSTRUCTIONS SMULL, SMLAL:
••If bits [31:8] of the multiplier operand are all zero or all one.
••If bits [31:16] of the multiplier operand are all zero or all one.
••If bits [31:24] of the multiplier operand are all zero or all one.
••In all other cases.
For Unsigned Instructions UMULL, UMLAL:
••If bits [31:8] of the multiplier operand are all zero.
••If bits [31:16] of the multiplier operand are all zero.
••If bits [31:24] of the multiplier operand are all zero.
••In all other cases.
S and I are defined as sequential (S-cycle) and internal (I-cycle), respectively.
3-26
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
ASSEMBLER SYNTAX
Table 3-5. Assembler Syntax Descriptions
MnemonicDescriptionPurpose
UMULL{cond}{S} RdLo,RdHi,Rm,RsUnsigned Multiply Long32 x 32 = 64
UMLAL{cond}{S} RdLo,RdHi,Rm,RsUnsigned Multiply & Accumulate Long32 x 32 + 64 = 64
SMULL{cond}{S} RdLo,RdHi,Rm,RsSigned Multiply Long32 x 32 = 64
SMLAL{cond}{S} RdLo,RdHi,Rm,RsSigned Multiply & Accumulate Long32 x 32 + 64 = 64
where:
{cond}Two-character condition mnemonic. See Table 3-2.
{S}Set condition codes if S present
RdLo, RdHi, Rm, Rs Expressions evaluating to a register number other than R15.
EXAMPLES
UMULLR1,R4,R2,R3; R4,R1:=R2*R3
UMLALSR1,R5,R2,R3; R5,R1:=R2*R3+R5,R1 also setting condition codes
3-27
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
SINGLE DATA TRANSFER (LDR, STR)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-14.
The single data transfer instructions are used to load or store single bytes or words of data. The memory address
used in the transfer is calculated by adding an offset to or subtracting an offset from a base register.
The result of this calculation may be written back into the base register if auto-indexing is required.
312719150
281611122123
Cond
262425
01I P UOffsetW
22
B20LRnRd
[15:12] Source/Destination Registers
[19:16] Base Register
[20] Load/Store Bit
0 = Store to memory
1 = Load from memory
[21] Write-back Bit
0 = No write-back
1 = Write address into base
[22] Byte/Word Bit
0 = Transfer word quantity
1 = Transfer byte quantity
[23] Up/Down Bit
0 = Down: subtract offset from base
1 = Up: add offset to base
[24] Pre/Post Indexing Bit
0 = Post: add offset after transfer
1 = Pre: add offset before transfer
3-28
[25] Immediate Offset
0 = Offset is an immediate value
[11:0] Offset
11
Immediate
[11:0] Unsigned 12-bit immediate offset
11
Shift
[3:0] Offset register[11:4] Shift applied to Rm
4 30
0
Rm
[31:28] Condition Field
Figure 3-14. Single Data Transfer Instructions
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
OFFSETS AND AUTO-INDEXING
The offset from the base may be either a 12 bit unsigned binary immediate value in the instruction, or a second
register (possibly shifted in some way). The offset may be added to (U=1) or subtracted from (U=0) the base
register Rn. The offset modification may be performed either before (pre-indexed, P=1) or after (post-indexed,
P=0) the base is used as the transfer address.
The W bit gives optional auto increment and decrement addressing modes. The modified base value may be
written back into the base (W=1), or the old base value may be kept (W=0). In the case of post-indexed
addressing, the write back bit is redundant and is always set to zero, since the old base value can be retained by
setting the offset to zero. Therefore post-indexed data transfers always write back the modified base. The only
use of the W bit in a post-indexed data transfer is in privileged mode code, where setting the W bit forces nonprivileged mode for the transfer, allowing the operating system to generate a user address in a system where the
memory management hardware makes suitable use of this hardware.
SHIFTED REGISTER OFFSET
The 8 shift control bits are described in the data processing instructions section. However, the register specified
shift amounts are not available in this instruction class. See Figure 3-5.
BYTES AND WORDS
This instruction class may be used to transfer a byte (B=1) or a word (B=0) between an ARM7TDMI register and
memory.
The action of LDR(B) and STR(B) instructions is influenced by the BIGEND control signal of ARM7TDMI core.
The two possible configurations are described below.
Little-Endian Configuration
A byte load (LDRB) expects the data on data bus inputs 7 through 0 if the supplied address is on a word
boundary, on data bus inputs 15 through 8 if it is a word address plus one byte, and so on. The selected byte is
placed in the bottom 8 bits of the destination register, and the remaining bits of the register are filled with zeros.
Please see Figure 2-2.
A byte store (STRB) repeats the bottom 8 bits of the source register four times across data bus outputs 31
through 0. The external memory system should activate the appropriate byte subsystem to store the data.
A word load (LDR) will normally use a word aligned address. However, an address offset from a word boundary
will cause the data to be rotated into the register so that the addressed byte occupies bits 0 to 7. This means that
half-words accessed at offsets 0 and 2 from the word boundary will be correctly loaded into bits 0 through 15 of
the register. Two shift operations are then required to clear or to sign extend the upper 16 bits.
A word store (STR) should generate a word aligned address. The word presented to the data bus is not affected if
the address is not word aligned. That is, bit 31 of the register being stored always appears on data bus output 31.
3-29
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
A+3
A+2
A+1
A
A+3
A+2
A+1
A
memory
A
24
B
16
C
8
D
0
LDR from word aligned address
memory
A
24
B
16
C
8
D
0
LDR from address offset by 2
register
A
24
B
16
C
8
D
0
register
A
24
B
16
C
8
D
0
Figure 3-15. Little-Endian Offset Addressing
Big-Endian Configuration
A byte load (LDRB) expects the data on data bus inputs 31 through 24 if the supplied address is on a word
boundary, on data bus inputs 23 through 16 if it is a word address plus one byte, and so on. The selected byte is
placed in the bottom 8 bits of the destination register and the remaining bits of the register are filled with zeros.
Please see Figure 2-1.
A byte store (STRB) repeats the bottom 8 bits of the source register four times across data bus outputs 31
through 0. The external memory system should activate the appropriate byte subsystem to store the data.
A word load (LDR) should generate a word aligned address. An address offset of 0 or 2 from a word boundary will
cause the data to be rotated into the register so that the addressed byte occupies bits 31 through 24. This means
that half-words accessed at these offsets will be correctly loaded into bits 16 through 31 of the register. A shift
operation is then required to move (and optionally sign extend) the data into the bottom 16 bits. An address offset
of 1 or 3 from a word boundary will cause the data to be rotated into the register so that the addressed byte
occupies bits 15 through 8.
A word store (STR) should generate a word aligned address. The word presented to the data bus is not affected if
the address is not word aligned. That is, bit 31 of the register being stored always appears on data bus output 31.
3-30
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
USE OF R15
Write-back must not be specified if R15 is specified as the base register (Rn). When using R15 as the base
register you must remember it contains an address 8 bytes on from the address of the current instruction.
R15 must not be specified as the register offset (Rm).
When R15 is the source register (Rd) of a register store (STR) instruction, the stored value will be address of the
instruction plus 12.
RESTRICTION ON THE USE OF BASE REGISTER
When configured for late aborts, the following example code is difficult to unwind as the base register, Rn, gets
updated before the abort handler starts. Sometimes it may be impossible to calculate the initial value.
After an abort, the following example code is difficult to unwind as the base register, Rn, gets updated before the
abort handler starts. Sometimes it may be impossible to calculate the initial value.
EXAMPLE:
LDRR0,[R1],R1
Therefore a post-indexed LDR or STR where Rm is the same register as Rn should not be used.
DATA ABORTS
A transfer to or from a legal address may cause problems for a memory management system. For instance, in a
system which uses virtual memory the required data may be absent from main memory. The memory manager
can signal a problem by taking the processor ABORT input HIGH whereupon the Data Abort trap will be taken. It
is up to the system software to resolve the cause of the problem, then the instruction can be restarted and the
original program continued.
INSTRUCTION CYCLE TIMES
Normal LDR instructions take 1S + 1N + 1I and LDR PC take 2S + 2N +1I incremental cycles, where S,N and I
are defined as sequential (S-cycle), non-sequential (N-cycle), and internal (I-cycle), respectively. STR instructions
take 2N incremental cycles to execute.
3-31
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
ASSEMBLER SYNTAX
<LDR|STR>{cond}{B}{T} Rd,<Address>
where:
LDRLoad from memory into a register
STRStore from a register into memory
{cond}Two-character condition mnemonic. See Table 3-2.
{B}If B is present then byte transfer, otherwise word transfer
{T}If T is present the W bit will be set in a post-indexed instruction, forcing non-privileged
mode for the transfer cycle. T is not allowed when a pre-indexed addressing mode is
specified or implied.
Rd An expression evaluating to a valid register number.
Rn and Rm Expressions evaluating to a register number. If Rn is R15 then the assembler will
subtract 8 from
the offset value to allow for ARM7TDMI pipelining. In this case base write-back should
not be specified.
<Address>can be:
1An expression which generates an address:
The assembler will attempt to generate an instruction using the PC as a base and a
corrected immediate offset to address the location given by evaluating the expression.
This will be a PC relative, pre-indexed address. If the address is out of range, an error
will be generated.
2A pre-indexed addressing specification:
[Rn] offset of zero
[Rn,<#expression>]{!}offset of <expression> bytes
[Rn,{+/-}Rm{,<shift>}]{!}offset of +/- contents of index register, shifted
by <shift>
3A post-indexed addressing specification:
[Rn],<#expression> offset of <expression> bytes
[Rn],{+/-}Rm{,<shift>} offset of +/- contents of index register, shifted as
by <shift>.
<shift>General shift operation (see data processing instructions) but you cannot specify the shift
amount by a register.
{!} Writes back the base register (set the W bit) if! is present.
3-32
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
EXAMPLES
STRR1,[R2,R4]!; Store R1 at R2+R4 (both of which are registers)
; and write back address to R2.
STRR1,[R2],R4; Store R1 at R2 and write back R2+R4 to R2.
LDRR1,[R2,#16]; Load R1 from contents of R2+16, but don't write back.
LDRR1,[R2,R3,LSL#2]; Load R1 from contents of R2+R3*4.
LDREQBR1,[R6,#5]; Conditionally load byte at R6+5 into
; R1 bits 0 to 7, filling bits 8 to 31 with zeros.
STRR1,PLACE; Generate PC relative offset to address PLACE.
PLACE
3-33
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
HALFWORD AND SIGNED DATA TRANSFER (LDRH/STRH/LDRSB/LDRSH)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-16.
These instructions are used to load or store half-words of data and also load sign-extended bytes or half-words of
data. The memory address used in the transfer is calculated by adding an offset to or subtracting an offset from a
base register. The result of this calculation may be written back into the base register if auto-indexing is required.
31271915
281611122123
Cond
22
2425
000P U0000W
0
20
LRnRd
[3:0] Offset Register
[6][5] S H
0 0 = SWP instruction
0 1 = Unsigned halfword
1 1 = Signed byte
1 1 = Signed halfword
[15:12] Source/Destination Register
[19:16] Base Register
[20] Load/Store
0 = Store to memory
1 = Load from memory
[21] Write-back
0 = No write-back
1 = Write address into base
[23] Up/Down
0 = Down: subtract offset from base
1 = Up: add offset to base
8 7 6 5 4 30
1RmS H 1
3-34
[24] Pre/Post Indexing
0 = Post: add/subtract offset after transfer
1 = Pre: add/subtract offset bofore transfer
[31:28] Condition Field
Figure 3-16. Halfword and Signed Data Transfer with Register Offset
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
31271915
281611122123
Cond
22
2425
000P UOffsetW
1
20
LRnRd
[3:0] Immediate Offset (Low Nibble)
[6][5] S H
0 0 = SWP instruction
0 1 = Unsigned halfword
1 1 = Signed byte
1 1 = Signed halfword
0 = Down: subtract offset from base
1 = Up: add offset to base
[24] Pre/Post Indexing
0 = Post: add/subtract offset after transfer
1 = Pre: add/subtract offset bofore transfer
[31:28] Condition Field
Figure 3-17. Halfword and Signed Data Transfer with Immediate Offset and Auto-Indexing
OFFSETS AND AUTO-INDEXING
The offset from the base may be either a 8-bit unsigned binary immediate value in the instruction, or a second
register. The 8-bit offset is formed by concatenating bits 11 to 8 and bits 3 to 0 of the instruction word, such that
bit 11 becomes the MSB and bit 0 becomes the LSB. The offset may be added to (U=1) or subtracted from (U=0)
the base register Rn. The offset modification may be performed either before (pre-indexed, P=1) or after (postindexed, P=0) the base register is used as the transfer address.
The W bit gives optional auto-increment and decrement addressing modes. The modified base value may be
written back into the base (W=1), or the old base may be kept (W=0). In the case of post-indexed addressing, the
write back bit is redundant and is always set to zero, since the old base value can be retained if necessary by
setting the offset to zero. Therefore post-indexed data transfers always write back the modified base.
The Write-back bit should not be set high (W=1) when post-indexed addressing is selected.
3-35
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
HALFWORD LOAD AND STORES
Setting S=0 and H=1 may be used to transfer unsigned Half-words between an ARM7TDMI register and memory.
The action of LDRH and STRH instructions is influenced by the BIGEND control signal. The two possible
configurations are described in the section below.
SIGNED BYTE AND HALFWORD LOADS
The S bit controls the loading of sign-extended data. When S=1 the H bit selects between Bytes (H=0) and Halfwords (H=1). The L bit should not be set low (Store) when Signed (S=1) operations have been selected.
The LDRSB instruction loads the selected Byte into bits 7 to 0 of the destination register and bits 31 to 8 of the
destination register are set to the value of bit 7, the sign bit.
The LDRSH instruction loads the selected Half-word into bits 15 to 0 of the destination register and bits 31 to 16
of the destination register are set to the value of bit 15, the sign bit.
The action of the LDRSB and LDRSH instructions is influenced by the BIGEND control signal. The two possible
configurations are described in the following section.
ENDIANNESS AND BYTE/HALFWORD SELECTION
Little-Endian Configuration
A signed byte load (LDRSB) expects data on data bus inputs 7 through to 0 if the supplied address is on a word
boundary, on data bus inputs 15 through to 8 if it is a word address plus one byte, and so on. The selected byte is
placed in the bottom 8 bit of the destination register, and the remaining bits of the register are filled with the sign
bit, bit 7 of the byte. Please see Figure 2-2.
A halfword load (LDRSH or LDRH) expects data on data bus inputs 15 through to 0 if the supplied address is on a
word boundary and on data bus inputs 31 through to 16 if it is a halfword boundary, (A[1]=1).The supplied
address should always be on a halfword boundary. If bit 0 of the supplied address is HIGH then the ARM7TDMI
will load an unpredictable value. The selected halfword is placed in the bottom 16 bits of the destination register.
For unsigned half-words (LDRH), the top 16 bits of the register are filled with zeros and for signed half-words
(LDRSH) the top 16 bits are filled with the sign bit, bit 15 of the halfword.
A halfword store (STRH) repeats the bottom 16 bits of the source register twice across the data bus outputs 31
through to 0. The external memory system should activate the appropriate halfword subsystem to store the data.
Note that the address must be halfword aligned, if bit 0 of the address is HIGH this will cause unpredictable
behaviour.
3-36
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
Big-Endian Configuration
A signed byte load (LDRSB) expects data on data bus inputs 31 through to 24 if the supplied address is on a
word boundary, on data bus inputs 23 through to 16 if it is a word address plus one byte, and so on. The selected
byte is placed in the bottom 8 bit of the destination register, and the remaining bits of the register are filled with
the sign bit, bit 7 of the byte. Please see Figure 2-1.
A halfword load (LDRSH or LDRH) expects data on data bus inputs 31 through to 16 if the supplied address is on
a word boundary and on data bus inputs 15 through to 0 if it is a halfword boundary, (A[1]=1). The supplied
address should always be on a halfword boundary. If bit 0 of the supplied address is HIGH then the ARM7TDMI
will load an unpredictable value. The selected halfword is placed in the bottom 16 bits of the destination register.
For unsigned half-words (LDRH), the top 16 bits of the register are filled with zeros and for signed half-words
(LDRSH) the top 16 bits are filled with the sign bit, bit 15 of the halfword.
A halfword store (STRH) repeats the bottom 16 bits of the source register twice across the data bus outputs 31
through to 0. The external memory system should activate the appropriate halfword subsystem to store the data.
Note that the address must be halfword aligned, if bit 0 of the address is HIGH this will cause unpredictable
behaviour.
USE OF R15
Write-back should not be specified if R15 is specified as the base register (Rn). When using R15 as the base
register you must remember it contains an address 8 bytes on from the address of the current instruction.
R15 should not be specified as the register offset (Rm).
When R15 is the source register (Rd) of a Half-word store (STRH) instruction, the stored address will be address
of the instruction plus 12.
DATA ABORTS
A transfer to or from a legal address may cause problems for a memory management system. For instance, in a
system which uses virtual memory the required data may be absent from the main memory. The memory
manager can signal a problem by taking the processor ABORT input HIGH whereupon the Data Abort trap will be
taken. It is up to the system software to resolve the cause of the problem, then the instruction can be restarted
and the original program continued.
INSTRUCTION CYCLE TIMES
Normal LDR(H,SH,SB) instructions take 1S + 1N + 1I. LDR(H,SH,SB) PC take 2S + 2N + 1I incremental cycles.
S,N and I are defined as sequential (S-cycle), non-sequential (N-cycle), and internal (I-cycle), respectively. STRH
instructions take 2N incremental cycles to execute.
3-37
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
ASSEMBLER SYNTAX
<LDR|STR>{cond}<H|SH|SB> Rd,<address>
LDRLoad from memory into a register
STRStore from a register into memory
{cond}Two-character condition mnemonic. See Table 3-2..
HTransfer halfword quantity
SBLoad sign extended byte (Only valid for LDR)
SHLoad sign extended halfword (Only valid for LDR)
RdAn expression evaluating to a valid register number.
<address> can be:
1An expression which generates an address:
The assembler will attempt to generate an instruction using the PC as a base and a
corrected immediate offset to address the location given by evaluating the expression.
This will be a PC relative, pre-indexed address. If the address is out of range, an error
will be generated.
2A pre-indexed addressing specification:
[Rn]offset of zero
[Rn,<#expression>]{!} offset of <expression> bytes
[Rn,{+/-}Rm]{!} offset of +/- contents of index register
3A post-indexed addressing specification:
[Rn],<#expression>offset of <expression> bytes
[Rn],{+/-}Rmoffset of +/- contents of index register.
4Rn and Rm are expressions evaluating to a register number. If Rn is R15 then the
assembler will subtract 8 from the offset value to allow for ARM7TDMI pipelining. In this
case base write-back should not be specified.
{!}Writes back the base register (set the W bit) if ! is present.
3-38
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
EXAMPLES
LDRHR1,[R2,-R3]!; Load R1 from the contents of the halfword address
; contained in R2-R3 (both of which are registers)
; and write back address to R2
STRHR3,[R4,#14]; Store the halfword in R3 at R14+14 but don't write back.
LDRSBR8,[R2],#-223; Load R8 with the sign extended contents of the byte
; address contained in R2 and write back R2-223 to R2.
LDRNESHR11,[R0]; Conditionally load R11 with the sign extended contents
; of the halfword address contained in R0.
HERE; Generate PC relative offset to address FRED.
STRHR5, [PC,#(FRED-HERE-8)]; Store the halfword in R5 at address FRED
FRED
3-39
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
BLOCK DATA TRANSFER (LDM, STM)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-18.
Block data transfer instructions are used to load (LDM) or store (STM) any subset of the currently visible
registers. They support all possible stacking modes, maintaining full or empty stacks which can grow up or down
memory, and are very efficient instructions for saving or restoring context, or for moving large blocks of data
around main memory.
THE REGISTER LIST
The instruction can cause the transfer of any registers in the current bank (and non-user mode programs can also
transfer to and from the user bank, see below). The register list is a 16 bit field in the instruction, with each bit
corresponding to a register. A 1 in bit 0 of the register field will cause R0 to be transferred, a 0 will cause it not to
be transferred; similarly bit 1 controls the transfer of R1, and so on.
Any subset of the registers, or all the registers, may be specified. The only restriction is that the register list
should not be empty.
Whenever R15 is stored to memory the stored value is the address of the STM instruction plus 12.
31271915
28162123
Cond
20
22
2425
240
S
100P UW
LRn
[19:16] Base Register
[20] Load/Store Bit
0 = Store to memory
1 = Load from memory
[21] Write-back Bit
0 = No write-back
1 = Write address into base
[22] PSR & Force User Bit
0 = Do not load PSR or user mode
1 = Load PSR or force user mode
[23] Up/Down Bit
0 = Down: subtract offset from base
1 = Up: add offset to base
[24] Pre/Post Indexing Bit
0 = Post: add offset after transfer
1 = Pre: add offset bofore transfer
Register list
3-40
[31:28] Condition Field
Figure 3-18. Block Data Transfer Instructions
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
ADDRESSING MODES
The transfer addresses are determined by the contents of the base register (Rn), the pre/post bit (P) and the up/
down bit (U). The registers are transferred in the order lowest to highest, so R15 (if in the list) will always be
transferred last. The lowest register also gets transferred to/from the lowest memory address. By way of
illustration, consider the transfer of R1, R5 and R7 in the case where Rn=0x1000 and write back of the modified
base is required (W=1). Figure 3.19-22 show the sequence of register transfers, the addresses used, and the
value of Rn after the instruction has completed.
In all cases, had write back of the modified base not been required (W=0), Rn would have retained its initial value
of 0x1000 unless it was also in the transfer list of a load multiple register instruction, when it would have been
overwritten with the loaded value.
ADDRESS ALIGNMENT
The address should normally be a word aligned quantity and non-word aligned addresses do not affect the
instruction. However, the bottom 2 bits of the address will appear on A[1:0] and might be interpreted by the
memory system.
0x100C
RnR1
12
R5
R1
34
0x1000
0x0FF4
0x100C
0x1000
0x0FF4
Rn
R7
R5
R1
Figure 3-19. Post-Increment Addressing
0x100C
0x1000
0x0FF4
0x100C
0x1000
0x0FF4
3-41
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
Rn
0x100C
R1
0x1000
0x0FF4
1
0x100C
R5
R1
0x1000
0x0FF4
3
2
R7Rn
R5
R1
4
Figure 3-20. Pre-Increment Addressing
0x100C
0x1000
0x0FF4
0x100C
0x1000
0x0FF4
Rn
0x100C
0x1000
R1
0x0FF4
1
R5
R1
3
0x100C
0x1000
0x0FF4
Rn
2
R7
R5
R1
4
Figure 3-21. Post-Decrement Addressing
0x100C
0x1000
0x0FF4
0x100C
0x1000
0x0FF4
3-42
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
Rn
0x100C
0x1000
R1
2
R7
R5
R1
4
1
R5
R1
3
0x0FF4
0x100C
0x1000
0x0FF4
Rn
Figure 3-22. Pre-Decrement Addressing
0x100C
0x1000
0x0FF4
0x100C
0x1000
0x0FF4
USE OF THE S BIT
When the S bit is set in a LDM/STM instruction its meaning depends on whether or not R15 is in the transfer list
and on the type of instruction. The S bit should only be set if the instruction is to execute in a privileged mode.
LDM with R15 in Transfer List and S Bit Set (Mode Changes)
If the instruction is a LDM then SPSR_<mode> is transferred to CPSR at the same time as R15 is loaded.
STM with R15 in Transfer List and S Bit Set (User Bank Transfer)
The registers transferred are taken from the User bank rather than the bank corresponding to the current mode.
This is useful for saving the user state on process switches. Base write-back should not be used when this
mechanism is employed.
R15 not in List and S Bit Set (User Bank Transfer)
For both LDM and STM instructions, the User bank registers are transferred rather than the register bank
corresponding to the current mode. This is useful for saving the user state on process switches. Base write-back
should not be used when this mechanism is employed.
When the instruction is LDM, care must be taken not to read from a banked register during the following cycle
(inserting a dummy instruction such as MOV R0, R0 after the LDM will ensure safety).
USE OF R15 AS THE BASE
R15 should not be used as the base register in any LDM or STM instruction.
3-43
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
INCLUSION OF THE BASE IN THE REGISTER LIST
When write-back is specified, the base is written back at the end of the second cycle of the instruction. During a
STM, the first register is written out at the start of the second cycle. A STM which includes storing the base, with
the base as the first register to be stored, will therefore store the unchanged value, whereas with the base second
or later in the transfer order, will store the modified value. A LDM will always overwrite the updated base if the
base is in the list.
DATA ABORTS
Some legal addresses may be unacceptable to a memory management system, and the memory manager can
indicate a problem with an address by taking the ABORT signal HIGH. This can happen on any transfer during a
multiple register load or store, and must be recoverable if ARM7TDMI is to be used in a virtual memory system.
Abort during STM Instructions
If the abort occurs during a store multiple instruction, ARM7TDMI takes little action until the instruction
completes, whereupon it enters the data abort trap. The memory manager is responsible for preventing
erroneous writes to the memory. The only change to the internal state of the processor will be the modification of
the base register if write-back was specified, and this must be reversed by software (and the cause of the abort
resolved) before the instruction may be retried.
Aborts during LDM Instructions
When ARM7TDMI detects a data abort during a load multiple instruction, it modifies the operation of the
instruction to ensure that recovery is possible.
•Overwriting of registers stops when the abort happens. The aborting load will not take place but earlier ones
may have overwritten registers. The PC is always the last register to be written and so will always be
preserved.
•The base register is restored, to its modified value if write-back was requested. This ensures recoverability in
the case where the base register is also in the transfer list, and may have been overwritten before the abort
occurred.
The data abort trap is taken when the load multiple has completed, and the system software must undo any base
modification (and resolve the cause of the abort) before restarting the instruction.
INSTRUCTION CYCLE TIMES
Normal LDM instructions take nS + 1N + 1I and LDM PC takes (n+1)S + 2N + 1I incremental cycles, where S,N
and I are defined as sequential (S-cycle), non-sequential (N-cycle), and internal (I-cycle), respectively. STM
instructions take (n-1)S + 2N incremental cycles to execute, where n is the number of words transferred.
3-44
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
ASSEMBLER SYNTAX
<LDM|STM>{cond}<FD|ED|FA|EA|IA|IB|DA|DB> Rn{!},<Rlist>{^}
where:
{cond}Two character condition mnemonic. See Table 3-2.
RnAn expression evaluating to a valid register number
<Rlist>A list of registers and register ranges enclosed in {} (e.g. {R0,R2-R7,R10}).
{!}If present requests write-back (W=1), otherwise W=0.
{^} If present set S bit to load the CPSR along with the PC, or force transfer of user bank
when in privileged mode.
Addressing Mode Names
There are different assembler mnemonics for each of the addressing modes, depending on whether the
instruction is being used to support stacks or for other purposes. The equivalence between the names and the
values of the bits in the instruction are shown in the following table 3-6.
FD, ED, FA, EA define pre/post indexing and the up/down bit by reference to the form of stack required. The F
and E refer to a "full" or "empty" stack, i.e. whether a pre-index has to be done (full) before storing to the stack.
The A and D refer to whether the stack is ascending or descending. If ascending, a STM will go up and LDM
down, if descending, vice-versa.
IA, IB, DA, DB allow control when LDM/STM are not being used for stacks and simply mean Increment After,
Increment Before, Decrement After, Decrement Before.
These instructions may be used to save state on subroutine entry, and restore it efficiently on return to the calling
routine:
STMEDSP!,{R0-R3,R14}; Save R0 to R3 to use as workspace
; and R14 for returning.
BLsomewhere; This nested call will overwrite R14
LDMEDSP!,{R0-R3,R15}; Restore workspace and return.
3-46
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
SINGLE DATA SWAP (SWP)
311915
281611122123
278 74 30
Cond
22
000100000Rm1001
B2000RnRd
[3:0] Source Register
[15:12] Destination Register
[19:16] Base Register
[22] Byte/Word Bit
0 = Swap word quantity
1 = Swap word quantity
[31:28] Condition Field
Figure 3-23. Swap Instruction
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-23.
The data swap instruction is used to swap a byte or word quantity between a register and external memory. This
instruction is implemented as a memory read followed by a memory write which are "locked" together (the
processor cannot be interrupted until both operations have completed, and the memory manager is warned to
treat them as inseparable). This class of instruction is particularly useful for implementing software semaphores.
The swap address is determined by the contents of the base register (Rn). The processor first reads the contents
of the swap address. Then it writes the contents of the source register (Rm) to the swap address, and stores the
old memory contents in the destination register (Rd). The same register may be specified as both the source and
destination.
The LOCK output goes HIGH for the duration of the read and write operations to signal to the external memory
manager that they are locked together, and should be allowed to complete without interruption. This is important
in multi-processor systems where the swap instruction is the only indivisible instruction which may be used to
implement semaphores; control of the memory must not be removed from a processor while it is performing a
locked operation.
BYTES AND WORDS
This instruction class may be used to swap a byte (B=1) or a word (B=0) between an ARM7TDMI register and
memory. The SWP instruction is implemented as a LDR followed by a STR and the action of these is as
described in the section on single data transfers. In particular, the description of Big and Little Endian
configuration applies to the SWP instruction.
3-47
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
USE OF R15
Do not use R15 as an operand (Rd, Rn or Rs) in a SWP instruction.
DATA ABORTS
If the address used for the swap is unacceptable to a memory management system, the memory manager can
flag the problem by driving ABORT HIGH. This can happen on either the read or the write cycle (or both), and in
either case, the Data Abort trap will be taken. It is up to the system software to resolve the cause of the problem,
then the instruction can be restarted and the original program continued.
INSTRUCTION CYCLE TIMES
Swap instructions take 1S + 2N +1I incremental cycles to execute, where S,N and I are defined as sequential
(S-cycle), non-sequential, and internal (I-cycle), respectively.
ASSEMBLER SYNTAX
<SWP>{cond}{B} Rd,Rm,[Rn]
{cond}Two-character condition mnemonic. See Table 3-2.
{B}If B is present then byte transfer, otherwise word transfer
Rd,Rm,RnExpressions evaluating to valid register numbers
EXAMPLES
SWPR0,R1,[R2]; Load R0 with the word addressed by R2, and
; store R1 at R2.
SWPBR2,R3,[R4]; Load R2 with the byte addressed by R4, and
; store bits 0 to 7 of R3 at R4.
SWPEQR0,R0,[R1]; Conditionally swap the contents of the
; word addressed by R1 with R0.
3-48
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
SOFTWARE INTERRUPT (SWI)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-24, below.
312427
2823
CondComment Field (Ignored by Processor)
1111
0
[31:28] Condition Field
Figure 3-24. Software Interrupt Instruction
The software interrupt instruction is used to enter Supervisor mode in a controlled manner. The instruction
causes the software interrupt trap to be taken, which effects the mode change. The PC is then forced to a fixed
value (0x08) and the CPSR is saved in SPSR_svc. If the SWI vector address is suitably protected (by external
memory management hardware) from modification by the user, a fully protected operating system may be
constructed.
RETURN FROM THE SUPERVISOR
The PC is saved in R14_svc upon entering the software interrupt trap, with the PC adjusted to point to the word
after the SWI instruction. MOVS PC,R14_svc will return to the calling program and restore the CPSR.
Note that the link mechanism is not re-entrant, so if the supervisor code wishes to use software interrupts within
itself it must first save a copy of the return address and SPSR.
COMMENT FIELD
The bottom 24 bits of the instruction are ignored by the processor, and may be used to communicate information
to the supervisor code. For instance, the supervisor may look at this field and use it to index into an array of entry
points for routines which perform the various supervisor functions.
INSTRUCTION CYCLE TIMES
Software interrupt instructions take 2S + 1N incremental cycles to execute, where S and N are defined as
sequential (S-cycle) and non-sequential (N-cycle).
3-49
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
ASSEMBLER SYNTAX
SWI{cond} <expression>
{cond}Two character condition mnemonic, Table 3-2.
<expression>Evaluated and placed in the comment field (which is ignored by ARM7TDMI).
EXAMPLES
SWIReadC; Get next character from read stream.
SWIWriteI+"k”; Output a "k" to the write stream.
SWINE0; Conditionally call supervisor with 0 in comment field.
Supervisor code
The previous examples assume that suitable supervisor code exists, for instance:
0x08 B Supervisor; SWI entry point
EntryTable ; Addresses of supervisor routines
DCD ZeroRtn
DCD ReadCRtn
DCD WriteIRtn
•••
ZeroEQU 0
ReadCEQU 256
WriteIEQU 512
Supervisor; SWI has routine required in bits 8-23 and data (if any) in
; bits 0-7. Assumes R13_svc points to a suitable stack
STMFDR13,{R0-R2,R14}; Save work registers and return address.
LDRR0,[R14,#-4]; Get SWI instruction.
BICR0,R0,#0xFF000000; Clear top 8 bits.
MOVR1,R0,LSR#8; Get routine offset.
ADRR2,EntryTable; Get start address of entry table.
LDRR15,[R2,R1,LSL#2]; Branch to appropriate routine.
WriteIRtn; Enter with character in R0 bits 0-7.
•••
LDMFDR13,{R0-R2,R15}^; Restore workspace and return,
; restoring processor mode and flags.
3-50
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
COPROCESSOR DATA OPERATIONS (CDP)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-25.
This class of instruction is used to tell a coprocessor to perform some internal operation. No result is
communicated back to ARM7TDMI, and it will not wait for the operation to complete. The coprocessor could
contain a queue of such instructions awaiting execution, and their execution can overlap other activity, allowing
the coprocessor and ARM7TDMI to perform independent tasks in parallel.
COPROCESSOR INSTRUCTIONS
The S3C44B0X, unlike some other ARM-based processors, does not have an external coprocessor interface. It
does not have a on-chip coprocessor also.
So then all coprocessor instructions will cause the undefined instruction trap to be taken on the S3C44B0X.
These coprocessor instructions can be emulated by the undefined trap handler. Even though external
coprocessor can not be connected to the S3C44B0X, the coprocessor instructions are still described here in full
for completeness. (Remember that any external coprocessor described in this section is a software emulation.)
Figure 3-25. Coprocessor Data Operation Instruction
Only bit 4 and bits 24 to 31 The coprocessor fields are significant to ARM7TDMI. The remaining bits are used by
coprocessors. The above field names are used by convention, and particular coprocessors may redefine the use
of all fields except CP# as appropriate. The CP# field is used to contain an identifying number (in the range 0 to
15) for each coprocessor, and a coprocessor will ignore any instruction which does not contain its number in the
CP# field.
The conventional interpretation of the instruction is that the coprocessor should perform an operation specified in
the CP Opc field (and possibly in the CP field) on the contents of CRn and CRm, and place the result in CRd.
3-51
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
INSTRUCTION CYCLE TIMES
Coprocessor data operations take 1S + bI incremental cycles to execute, where b is the number of cycles spent
in the coprocessor busy-wait loop.
S and I are defined as sequential (S-cycle) and internal (I-cycle).
ASSEMBLER SYNTAX
CDP{cond} p#,<expression1>,cd,cn,cm{,<expression2>}
{cond}Two character condition mnemonic. See Table 3-2.
p#The unique number of the required coprocessor
<expression1>Evaluated to a constant and placed in the CP Opc field
cd, cn and cm Evaluate to the valid coprocessor register numbers CRd, CRn and CRm respectively
<expression2> Where present is evaluated to a constant and placed in the CP field
EXAMPLES
CDPp1,10,c1,c2,c3; Request coproc 1 to do operation 10
; on CR2 and CR3, and put the result in CR1.
CDPEQp2,5,c1,c2,c3,2; If Z flag is set request coproc 2 to do operation 5 (type 2)
; on CR2 and CR3, and put the result in CR1.
3-52
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
COPROCESSOR DATA TRANSFERS (LDC, STC)
The instruction is only executed if the condition is true. The various conditions are defined in Table 3-2. The
instruction encoding is shown in Figure 3-26.
This class of instruction is used to load (LDC) or store (STC) a subset of a coprocessors's registers directly to
memory. ARM7TDMI is responsible for supplying the memory address, and the coprocessor supplies or accepts
the data and controls the number of words transferred.
31271915
281611122123
Cond
22
2425
110P UCP#W
N20LRnCRd
[7:0] Unsigned 8 Bit Immediate Offset
[11:8] Coprocessor Number
[15:12] Coprocessor Source/Destination Register
[19:16] Base Register
[20] Load/Store Bit
0 = Store to memory
1 = Load from memory
[21] Write-back Bit
0 = No write-back
1 = Write address into base
[22] Transfer Length
[23] Up/Down Bit
0 = Down: subtract offset from base
1 = Up: add offset to base
[24] Pre/Post Indexing Bit
0 = Post: add offset after transfer
1 = Pre: add offset before transfer
8 70
Offset
[31:28] Condition Field
Figure 3-26. Coprocessor Data Transfer Instructions
THE COPROCESSOR FIELDS
The CP# field is used to identify the coprocessor which is required to supply or accept the data, and a
coprocessor will only respond if its number matches the contents of this field.
The CRd field and the N bit contain information for the coprocessor which may be interpreted in different ways by
different coprocessors, but by convention CRd is the register to be transferred (or the first register where more
than one is to be transferred), and the N bit is used to choose one of two transfer length options. For instance
N=0 could select the transfer of a single register, and N=1 could select the transfer of all the registers for context
switching.
3-53
ARM INSTRUCTION SET S3C44B0X RISC MICROPROCESSOR
ADDRESSING MODES
ARM7TDMI is responsible for providing the address used by the memory system for the transfer, and the
addressing modes available are a subset of those used in single data transfer instructions. Note, however, that
the immediate offsets are 8 bits wide and specify word offsets for coprocessor data transfers, whereas they are
12 bits wide and specify byte offsets for single data transfers.
The 8 bit unsigned immediate offset is shifted left 2 bits and either added to (U=1) or subtracted from (U=0) the
base register (Rn); this calculation may be performed either before (P=1) or after (P=0) the base is used as the
transfer address. The modified base value may be overwritten back into the base register (if W=1), or the old
value of the base may be preserved (W=0). Note that post-indexed addressing modes require explicit setting of
the W bit, unlike LDR and STR which always write-back when post-indexed.
The value of the base register, modified by the offset in a pre-indexed instruction, is used as the address for the
transfer of the first word. The second word (if more than one is transferred) will go to or come from an address
one word (4 bytes) higher than the first transfer, and the address will be incremented by one word for each
subsequent transfer.
ADDRESS ALIGNMENT
The base address should normally be a word aligned quantity. The bottom 2 bits of the address will appear on
A[1:0] and might be interpreted by the memory system.
USE OF R15
If Rn is R15, the value used will be the address of the instruction plus 8 bytes. Base write-back to R15 must not
be specified.
DATA ABORTS
If the address is legal but the memory manager generates an abort, the data trap will be taken. The write-back of
the modified base will take place, but all other processor state will be preserved. The coprocessor is partly
responsible for ensuring that the data transfer can be restarted after the cause of the abort has been resolved,
and must ensure that any subsequent actions it undertakes can be repeated when the instruction is retried.
INSTRUCTION CYCLE TIMES
Coprocessor data transfer instructions take (n-1)S + 2N + bI incremental cycles to execute, where:
nThe number of words transferred.
b The number of cycles spent in the coprocessor busy-wait loop.
S, N and I are defined as sequential (S-cycle), non-sequential (N-cycle), and internal (I-cycle), respectively.
3-54
S3C44B0X RISC MICROPROCESSORARM INSTRUCTION SET
ASSEMBLER SYNTAX
<LDC|STC>{cond}{L} p#,cd,<Address>
LDCLoad from memory to coprocessor
STC Store from coprocessor to memory
{L} When present perform long transfer (N=1), otherwise perform short transfer (N=0)
{cond}Two character condition mnemonic. See Table 3-2..
p#The unique number of the required coprocessor
cdAn expression evaluating to a valid coprocessor register number that is placed in the
CRd field
<Address>can be:
1An expression which generates an address:
The assembler will attempt to generate an instruction using the PC as a base and a
corrected immediate offset to address the location given by evaluating the expression.
This will be a PC relative, pre-indexed address. If the address is out of range, an error
will be generated
2A pre-indexed addressing specification:
[Rn]offset of zero
[Rn,<#expression>]{!}offset of <expression> bytes
3A post-indexed addressing specification:
[Rn],<#expression offset of <expression> bytes
{!}write back the base register (set the W bit) if! is present
Rnis an expression evaluating to a valid
ARM7TDMI register number.
NOTE
If Rn is R15, the assembler will subtract 8 from the offset value to allow for ARM7TDMI pipelining.
EXAMPLES
LDCp1,c2,table; Load c2 of coproc 1 from address
; table, using a PC relative address.
STCEQLp2,c3,[R5,#24]!; Conditionally store c3 of coproc 2
; into an address 24 bytes up from R5,
; write this address back to R5, and use
; long transfer option (probably to store multiple words).
NOTE
Although the address offset is expressed in bytes, the instruction offset field is in words. The assembler
will adjust the offset appropriately.
3-55
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.