The ARM1 processor’s flags, reverse engineered

Conclusion

I expected to write a brief article on the ARM1 flags, but the topic turned out to be more complex than I expected.
This article got a bit out of hand, so congratulations if you made it to the end!
The flags are not the simple 8-bit register I expected, but are stored in dynamic latches with many control lines and inputs.
With careful examination, it is possible to explain how
the features and special cases described in the manual are implemented in the circuits. Studying the flags also explains the function of several of the control signals generated by the instruction decoder.

Now that you’ve seen the internals of the flag logic, you can use the
Visual ARM1 simulator to see the circuit in action.
Thanks to the Visual 6502 team for providing the simulator and ARM1 chip layout data.

Notes and references

[1]

Flags do not need to be bits in a register.
The IBM 1401 and Intel 8008, for instance, do not have status flags as part of a register. Flags in these computers were not assigned bit positions but exist more abstractly.
The Z-80 on the other hand, stores flags both in discrete latches and in a flag register, copying the flags between the two.
The MIPS architecture doesn’t have condition flags at all, but does both the test and the branch in the conditional branch instructions.

[2]

Was combining the flags and program counter into a single register in the ARM1 a clever idea or just bizarre?
On the positive side, this allowed the flags and PC to be saved or restored in a single transfer, rather than two operations.
It also allowed flags to be accessed without special flag instructions.
On the negative side, restricting the address space to 26 bits was bad in the long term. This decision also prevented adding more flags in the future. Combining the flags and PC in register R15 also required special-case handling for R15 for many instructions.

The ARM architecture moved away from the combined PC/flags with the ARMv3 architecture.
The flags were moved to separate registers: CPSR (Current processor status register) and SPSR (Saved Processor Status Register), allowing
32-bit addressing as well as additional flags and modes.
New instructions (MSR, MRS) were added to access the CPSR and SPSR.
(One ARMv3 processor of note is the
ARM610, used
in the Apple Newton.)
Details on the historical and modern ARM status registers are here.

(The ARM numbering scheme is rather confusing. Architecture version numbers (e.g. ARMv3)
don’t match up with the CPU numbers (e.g. ARM6).
More information on the ARM family numbering is
here.)

[3]

I discussed how the multiplexers in the ARM1 work earlier.
In brief, each input has an NMOS and PMOS transistor working together as a switch, allowing the input to be connected to the output.
The schematics show a single control line for each input;
the implementation has two lines since the PMOS control signal must be inverted.

[4]
Each signal in the simulator has a reference number that can be used to cross-reference the signals in other articles. Here are the key control signals used in the flags circuitry and their reference numbers:

[5]

You might wonder why the bus works in this way. This clocked dynamic logic is simpler than using logic gates to control the signal on the bus; only two transistors are needed to write a bit to the bus
and they can be attached to the bus at any location.
But why complement the bus? The reason is that it’s easier with CMOS to pull a line low than to pull a line high. An NMOS transistor can provide more current than a similar PMOS transistor.
And the reason for that is electrons (which carry the charge in NMOS) move faster than holes (which carry the charge in PMOS).
Ultimately, the B bus is complemented due to semiconductor physics.
(The Z-80 is another chip that has as complemented data bus.)

[6]

Later versions of the ARM architecture introduced additional modes and more duplicated banks.
Details are at ARMwiki.

Original article by Ken Shirrif at his website.

[tps_footer][/tps_footer]