Browse over 10,000 Electronics Projects

Reverse Engineering the ARM1 Processor’s Microinstructions

Reverse Engineering the ARM1 Processor’s Microinstructions

Fields in the microinstruction

This section describes the fields that make up the microinstruction. I am still working out all the details, so this is not 100% accurate. Refer to the floorplan diagram below to see the components involved.

Floorplan of the ARM1 chip, from ARM Evaluation System manual. (Bus labels are corrected from original.)

 

Floorplan of the ARM1 chip, from ARM Evaluation System manual. (Bus labels are corrected from original.)

seqs: sequencer control

This field specifies the cycle number for the next microinstruction. It is used by the Sequence Controller. It has the following values:

table.arm1-mi { border-collapse: collapse; border: 1px solid #ccc;} table.arm1-mi td {padding: 2px 8px 2px 20px;} table.arm1-mi th {border-bottom: 1px solid #ccc;}

Field Label Meaning
0 END End of the instruction
1 NEXT Move to next cycle in sequence
2 IF23 If not pencz, next cycle is 2; if pencz, next cycle is 3.
3 IF1E If not pencz, next cycle is 1; if pencz, ends the instruction.

The pencz signal from the priority encoder indicates all registers have been processed for a LDM/STM instruction.

Signal numbers: 8310, 8309. I’ve put this field first to make control flow clearer, but it is physically after rws in the PLA.

dinin: data in to B bus

This field indicates the value on the data pins should be read in to the B bus. It is used by the data bus controls.Signal number: 8111

sctls: shifter controls

This field specifies the shifter action at a high level. The Shift Decode block uses this field in combination with other instruction bits and values to determine the specific shift direction and amount.

Field Shifter action
0 Rs
1 DP instruction
2 ASL 2*instruction
3 byte to word
4 no shift
5 ASL 2 bits
6 nop (unused)
7 nop

 

Signal numbers: 8288, 8287, 8286. Note that bits 2 and 1 are reversed coming out of the PLA.

aluac: ALU latch A bus

This signal latches the A bus value as an ALU input. The ALU control logic generates latch controls 2370, 2371 from this signal.

aluctls: ALU mode controls

This field selects the ALU mode. The ALU decoder uses this field to generate the ALU control signals.

Field Operation Instructions
0 add/rsb for base register update / address LDM/STM/Data processing
1 add for branch/fault destination B/SWI
2 add/sub/nop for address computation LDR/STR
3 mov for register update, nop for abort LDM/LDR
4 add/rsb/mov for address computation LDM/STM
5 add/sub for base register update LDR/STR
6 rsb for link address update BL / SWI
7 op specified by instruction Data processing

 

Signal numbers: 8062, 8061, 8060

aluenb: ALU latch B bus

This signal latches the B bus value as an ALU input. The ALU control logic generates latch controls 7485, 7486 from this signal.

banken: update PSR mode

This signal causes the M0, M1, F and I flags in the PSR to be updated from the psrbank signals from the trap control circuit. This happens during fault handling. This signal is used by the flag circuitry.

psrw: PSR write

This signal indicates that the PSR is potentially being written by a LDM/STM block copy instruction. It controls writing the ALU bus to the flags, after some more logic. It also allows LDM/STM to access the user-mode registers via the S bit. This signal is used by the flag circuitry.

nben: data to B bus

This signal indicates that the register file should write to the B bus when nben is 0. This signal is used by the register control logic and the flag logic.

psren: PSR to B bus

When active, this signal enables writing the PSR to the B bus to save it during a trap. This signal is used by the flag logic.

abctls: register controls for A and B bus

This field controls which registers are read onto the A and B bus. This signal is used by the register control logic.



Advertisement1


Field A register selector B register selector
0 Instruction bits 16-19 (Rn) Instruction bits 0-3 (Rm)
1 Instruction bits 8-11 (Rs) Instruction bits 12-15 (Rd)
2 R15 Instruction bits 16-19 (Rn)
3 R15 From priority encoder
4 Instruction bits 16-19 (Rn) R14

 

Signal numbers: 8042, 8041, 8040

wctls: register write controls

This field selects which register gets written to, from the ALU bus. This signal is used by the register control logic.

Field Register selector
0 Instruction bits 16-19 (Rn)
1 Instruction bits 12-15 (Rd)
2 From priority encoder
3 R14 (link)

 

Signal numbers: 8356, 8355

opc: OPC opcode fetch signal

This signal goes to the OPC pin and indicates a new instruction is being fetched. It is also used by the pipeline state circuitry.Signal number: 8630

pipebl: pipeline control

This signal is used by the pipeline state circuitry. It apparently indicates the end of the instruction, except for STM. It is high throughout branches and faults, perhaps to clear the pipeline.Signal number: 8261

skpwen: register write enable controls

This field controls whether a write to the register file happens or not. It is used by the Instruction Skip circuitry which can block the write if the instruction is aborted. The following table is a rough draft.

Field Write condition
0 None
1 Not dataabort
2 Writeback
3 Instruction bit 24 (link)
4 Writeback / P bit
5 alureg
6 skpawen0

Signal numbers: 8324, 8323, 8322

skpw15: register 15 write controls

This signal controls writes to the R15 (PC). It is used by the Instruction Skip circuitry, perhaps to clear the pipeline when R15 is updated.Signal number: 8321

skparegs: address bus controls

This field controls what is written to the address bus. It is used by the Instruction Skip circuitry to generate the address bus controls. The following table is a rough draft.

Field Address source
0 Trap address
1 ALU bus
2 incrementer (normal) or ALU bus (for R15 write)
3 unincremented PC (normal) or ALU bus (for R15 write)
4 ALU bus or PC or incrementer, depending on R15 write and priority encoder
5 ALU bus or PC or incrementer, depending on R15 write and priority encoder
6 incrementer
7 unincremented PC (normal) or ALU bus (for R15 write)

 

Signal numbers: 8320, 8319, 8318

undef: undefined instruction

This signal is generated for an undefined instruction (specifically a coprocessor instruction). It is used by the Trap Control circuitry to generate a fault.Signal number: 8348

rws: read or write select

This signal controls the RW output; it is 1 for a read and 0 for a write. The Trap Control circuitry gates this (apparently to block writes on an address exception) and the signal then drives the RW pin.Signal number: 8284

pencen: priority encoder A bus control

This field controls writing of the bit counter output (times 4) to the A bus. It can also set the two low bits, either for the constant 3, or to add 3 to the bit counter output. The constant 3 is used (with borrow) to subtract 4 from R14 during a branch with link, see page 233 of VLSI RISC Architecture and Organization. The modified bit counter output is used to compute the LDM/STM start address.

Field Bit counter action on A bus
0 None
1 Low bits set (3)
2 Bit count
3 Bit count, low bits set

Signal numbers: 8202, 8201

bws: enable byte/word select

This signal indicates that byte/word should be selected by instruction bit 22, for LDR/STR. This signal is used by the Data Control (field extraction) circuitry.

dctls: data bus field extraction controls

This field controls which bits of the data bus or instruction are passed to the B bus. This field is used by the Data Control (field extraction) circuitry.

Field Selected data bus field
0 Select a byte or word depending on bw
1 24 bits (branch offset)
2 12 bits (LDR/STR offset)
3 byte (immediate instr)

For field 0, the byte is specified by controls 8195 and 8194.

Pages: 1 2 3 4 5 6 7

 


Top