3

This is a question about the ARMv4 architecture, particularly as embodied by the ARM7TDMI processor.

Does writing to R15 using LDR flush the pipeline? Naturally, it's clearly documented that BX flushes the pipeline (quote from page 4-6 of ARM DDI 0029E):

The branch causes a pipeline flush and refill from the address specified by Rn.

But I can't find any mention in datasheets ARM DDI 0029E or ARM DDI 0100BI of what should happen when R15 is targeted using LDR.

As a concrete example, would:

LDR R15, [R15, 0x24]

be expected to flush the pipeline?

3
  • 2
    10.5 of your first link says that whenever PC is written, the instruction pipeline is refilled before any further execution takes place. Commented Nov 17 at 15:22
  • 1
    In any case, would this be observable by software? ARM has never had branch delay slots AFAIK, so regardless of the pipeline state, the effects of the subsequent instructions must not become visible. Are you asking at the level of the bus, or trying to make a cycle-accurate emulator? Commented Nov 17 at 15:30
  • 1
    @NateEldredge Well spotted. I was searching for the string “flush”, and the info used the word “invalidate”…
    – jogloran
    Commented Nov 17 at 17:51

1 Answer 1

0

The effect of performing an LDR or LDM with R15 as a destination has always been well specified in cases where the least significant bit of R15 wouldn't be affected. None of the instructions following the LDR or LDM will in any way affect program execution except in the case where the loaded value matched their address, or in the case where the LDR or LDM had a conditional skip modifier causing the instruction to be skipped.

On the ARM7-TDMI, the execution time of every instruction which has R15 as the destination, or (for LDM) one of the destinations, is specified as taking two cycles longer than the corresponding instruction would take with any other destination. This is most likely a natural consequence of the ARM7-TDMI needing to perform at least two cycles worth of preparatory work before executing each instruction, and needing to abandon any such work that had been performed on the two instruction words following the instruction modifying A15, but I don't think the "official" data specifies the internal workings in such detail.

An interesting feature of the ARM-TDMI, by the way, is that any bus failure that might occur while fetching an instruction will not have any effect unless or until all previous instructions have finished execution. If e.g. attempts to access memory address 0x00008000 and 0x00008004 would trigger bus faults, and address 0x00007FFC holds instruction LDR R15,[R0], then the bus interface would report a fault on the cycle before that instruction would be executed, and another fault while that instruction was being executed, but the act of writing to R15 would prevent those pending fault conditions from affecting program behavior.

Notet that if an attempt were made to execute code from a region of space where reads could trigger side effects, the core would have no way of reverting those effects if the fetched instructions were abandoned. If memory serves, the intention was that the core would tell the bus interface which accesses were code fetches and which were loads, and that the bus interface would respond to any attempt to fetch code from an I/O address by reporting a bus fault back to the core but otherwise ignoring the attempt. If the fetch had been performed speculatively for an instruction that never ended up being executed, it would have no effect, and if an attempt were made to execute the instruction it would trigger a bus fault since any such attempts would almost certainly be accidental and erroneous.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .